Scripts in Your Origin
Cross-Site Scripting (XSS) occurs when an attacker injects JavaScript into a web page that runs in a user's browser under the target site's origin. This JavaScript inherits all the permissions of the logged-in user: it can read cookies, steal authentication tokens, access sensitive data in the DOM, and perform actions on the user's behalf.
If a comment form allows HTML and an attacker posts '<script>fetch(/admin)</script>', that script runs in the browser of every user who views the comment. Unlike a breach of the server, XSS doesn't require the attacker to compromise backend systems; it leverages the user's own browser and permissions.
Stored, Reflected, and DOM-based Variants
Stored XSS persists in the database (comments, profiles). Reflected XSS lives in a URL parameter and executes when the page echoes it back without escaping. DOM-based XSS manipulates the page's JavaScript directly without involving the server, often by reading window.location.hash or form inputs.
Defenses include output encoding (escaping HTML/JavaScript characters so they render as text, not code), Content Security Policy (restricting which origins scripts can load from), httpOnly cookies (preventing JavaScript from reading authentication tokens), and input validation (rejecting suspicious patterns). Modern frameworks like React and Vue escape output by default, eliminating the most common variants.