- Cross-Site-Scripting (XSS)
- In case of XSS, the attacker makes the victim’s browser execute a script (mostly ) that has been injected by the attacker while visiting a trusted web site. The attacker has several ways of injecting the into a web site that the victim trusts. Also check
- used to steal hijack user session
- steal sensitive information
- PII data
- conduct phishing attacks
- install a keylogger on the site affected by XSS
- Reading JWTs from localStorage
- don’t store in the local storage
- Cross Frame Scripting
- Cross-Frame Scripting (XFS) is an attack that combines malicious with an iframe that loads a legitimate page in an effort to steal data from an unsuspecting user
X-Frame-Options HTTP response header can be used to indicate whether or not a browser should be allowed to render a page in a
- validate input
- process of ensuring an application is rendering the correct data and preventing malicious data from doing harm to the site, database, and users
- sanitize data
- escape data
- The purpose of the flag is to make the value of the cookie unavailable from , so that it can not be stolen if there is a XSS vulnerability.
The HTTP Content-Security-Policy response header allows web site administrators to control resources the user agent is allowed to load for a given page. With a few exceptions, policies mostly involve specifying server origins and script endpoints
This policy allows images, scripts, AJAX, and CSS from the same origin, and does not allow any other resources to load (eg. object, frame, media, etc).
The X-XSS-Protection header is designed to enable the cross-site scripting (XSS) filter built into modern web browsers. This is usually enabled by default, but using it will enforce it.
1; mode=block value also enables the XSS Filter and rather than sanitize the page, when an XSS attack is detected, the browser will prevent rendering of the page