XSS Prevention Référence
Référence pour Cross-Site Scripting prevention: codage, CSP, sanitization, et trusted types.
XSS Types
Reflected XSS injects script via query parameters reflected in the response. Stored XSS persists payload in the database, affecting all viewers. DOM XSS manipulates client-side DOM without server involvement (source-to-sink data flow). Mutation XSS exploits browser HTML parsing quirks to bypass sanitization. All types execute attacker JavaScript in the victim's context, enabling session theft, credential exfiltration, and actions on behalf of the user.
- reflected
- Query param injection
- stored
- Database persistence
- DOM
- Client-side only
non-persistentaffects all usersno server roundtripPrevention Techniques
Context-aware output encoding is the primary defense: HTML-encode for HTML context, attribute-encode for attributes, JS-encode for script, URL-encode for URLs. CSP with nonces or hashes provides defense in depth. DOMPurify sanitizes HTML for rich text. Trusted Types (browser API) enforce type-safe DOM sink access, preventing DOM XSS. Avoid innerHTML; use textContent or createElement. Frameworks (React, Angular) auto-encode by default but have escape hatches that need care.
- encoding
- Context-aware
- CSP
- Defense in depth
- Trusted Types
- Type-safe sinks
primary defensenonce/hashDOM XSS prevention