Securing Node Applications

Chapter 3. Cross-Site Scripting

Cross-site scripting (XSS) is the most prevalent web application security flaw. Attackers use XSS for a variety of intents, such as hijacking a user session, navigating a user to a malicious page, logging keystrokes, manipulating page contents, posting data to a remote server, or installing a malicious program on a user’s machine.

In this chapter, we learn about XSS attack mechanics and ways to protect against it.

Attack Mechanics

The key mechanism behind XSS attack is content injection, wherein an attacker inserts malicious JavaScript content on a web page. Attackers typically inject just a tiny bit of initial script, which, when executed, downloads additional required scripts.

Depending on whether the target web application saves the injected malicious content on the server, there are two primary XSS attack mechanisms: reflected and stored. Let’s review each of these mechanisms in more detail.

Reflected XSS

In this mechanism, an attacker provides a link to the victim user with malicious contents embedded in request parameters. When a victim user clicks this link, a request goes to the target application server, where a flaw in the application code results in including the malicious content in the request as-is in the response body. When the contents of this response load on the user’s browser, the malicious code executes, causing a successful XSS attack.

For apps that generate page content on the client side, the reflected XSS can still manifest ...