---
title: "XSS"
description: "XSS is an attack that injects a malicious script into a page shown to other users. See how it works and how to defend against it."
url: "https://nodea.io/en/glossary/xss"
lang: "en"
updated: "2026-07-13"
---

# XSS

> XSS (Cross-Site Scripting) is a vulnerability in which an attacker injects a malicious script into a page, which then runs in other users' browsers.

**XSS** (Cross-Site Scripting) is one of the most common web application vulnerabilities. It consists of injecting malicious code, most often [JavaScript](https://nodea.io/en/glossary/javascript), into the content of a page that is then displayed and executed in the browser of another, unsuspecting user. The script runs in the context of the trusted site, so it can steal session cookies, capture form data or perform actions on the victim's behalf.

## Types of XSS

There are three main variants. Stored XSS saves the payload on the server — for example in a comment — and attacks everyone who opens the infected page. Reflected XSS carries the payload in a URL and runs when the victim clicks a crafted link. DOM-based XSS manipulates the page entirely in the browser. In every case the root cause is trusting unverified input.

## Protection

Effective defence combines several layers. It is essential to encode output according to its context (HTML, attribute, JavaScript) and to validate input. A Content-Security-Policy header limits where the browser may load and execute scripts from, and marking cookies as HttpOnly makes them harder to steal. Transmission over [HTTPS](https://nodea.io/en/glossary/https) protects data in transit, and a web application [firewall](https://nodea.io/en/glossary/firewall) (WAF) can filter out common attack patterns. XSS is often combined with other techniques, such as [CSRF](https://nodea.io/en/glossary/csrf-cross-site-request-forgery), so application security should be treated holistically rather than as a single patch. Regular security testing and keeping dependencies up to date help catch XSS vulnerabilities before they reach production and are exploited.

### How do you protect against XSS?

The basics are validating input and encoding output (escaping) for the context in which it is displayed. A Content-Security-Policy header that limits where scripts may come from also helps significantly.

## Related

- [CSRF (Cross-Site Request Forgery)](https://nodea.io/en/glossary/csrf-cross-site-request-forgery)
- [SQL injection](https://nodea.io/en/glossary/sql-injection)
- [Firewall](https://nodea.io/en/glossary/firewall)
- [HTTPS](https://nodea.io/en/glossary/https)

---

Languages: [pl](https://nodea.pl/pl/slownik-pojec/xss.md)  
Site index: [llms.txt](https://nodea.io/en/llms.txt)