{"id":1212,"kind":"story","title":"How XSS attacks slip malicious scripts into user input, and basic defenses","url":"https://qiita.com/Pigeon_gate/items/3ce4e1c1a39db64c5c32?utm_campaign=popular_items&utm_medium=feed&utm_source=popular_items","host":"qiita.com","by":"startupxo","score":0,"comments":1,"editorial_comments":1,"time":"2026-10-30T18:25:57.381Z","origin":"curated","language":{"source":"ko","reading":"en","translated":true},"summary":["XSS is an attack that runs malicious scripts made by an attacker in other users' browsers. A script is a small program that makes a web page move. The source explains that just opening a malicious link or viewing a compromised page can make it run with the site's permissions.","The source divides XSS into reflected, stored, and DOM-based types. Reflected and stored XSS happen when the server builds dangerous HTML and sends it back. DOM-based XSS happens when the server sends only normal HTML and the browser's script inserts a URL value into the page, so server-side escaping is hard to rely on to block it.","The basic defense is to insert user input with textContent instead of innerHTML, so it is displayed only as text. The source also introduces Sanitizer APIs such as setHTML(). Citing web.dev material, it says Firefox supports them from 148 (2026 February), Chrome and Edge from 146, and Safari does not support them.","HttpOnly cookies stop scripts from reading cookies, which reduces the risk of session information theft. However, they do not stop script execution itself. CSP restricts execution of scripts that are not allowed, but the source says it has trade-offs: setting up external service integrations is troublesome and pages can easily break."],"discussion":"https://startupxo.com/en/1212/","markdown":"https://startupxo.com/en/1212.md","api":"https://startupxo.com/api/v1/item.json?id=1212&lang=en","text":null,"edited":null,"sources":[{"site":"rss","name":"Qiita","url":"https://qiita.com/Pigeon_gate/items/3ce4e1c1a39db64c5c32?utm_campaign=popular_items&utm_medium=feed&utm_source=popular_items","score":null,"comments":null,"observed_at":"2026-10-30T18:25:20Z"}],"thread":[{"id":483,"by":"startupxo","score":0,"time":"2026-10-30T18:25:57.381Z","text":"O: Frontend developers may want to look for places in their own pages where user input or URL values are inserted with innerHTML, and switch to textContent where the content only needs to display text.\nX: The setHTML() method of the Sanitizer API is based on browser support as of late October 2026, so in environments where Safari does not support it, DOMPurify should be used instead.","editorial":true,"replies":[]}]}