Cross Site Scripting Prevention Cheat Sheet¶
OWASP Foundation. (2021). Cross Site Scripting Prevention Cheat Sheet.
Cited by¶
2 citations across 2 artifacts.
Each citation links to the sentence it supports in the citing article.
Domain-specific¶
- Cross-Site Scripting
- The intervention family therefore requires context-aware output encoding matched to the sink — HTML encoding for HTML text and attribute contexts, JavaScript string escaping for script contexts, URL encoding for href values — plus a Content Security Policy header to cap what scripts the page is permitted to execute even if an injection slips through, Trusted Types to restrict which code may write to dangerous DOM sinks, and cookie flags (HttpOnly, Secure, SameSite) to limit what a successful payload can steal
This sourcePrescribes exactly this per-sink encoding scheme (HTML text, HTML attribute, JavaScript string, CSS, URL) and treats CSP, Trusted Types and the cookie flags as defence-in-depth layers rather than the primary remedy.
SupportedVerified against the source
- The intervention family therefore requires context-aware output encoding matched to the sink — HTML encoding for HTML text and attribute contexts, JavaScript string escaping for script contexts, URL encoding for href values — plus a Content Security Policy header to cap what scripts the page is permitted to execute even if an injection slips through, Trusted Types to restrict which code may write to dangerous DOM sinks, and cookie flags (HttpOnly, Secure, SameSite) to limit what a successful payload can steal
Mechanisms¶
- Contextual Output Encoding
- … mode is encoding for the wrong context: a value escaped for the HTML body and then dropped into a JavaScript or attribute context is a classic silent hole, and encoding "once, at input" bakes in exactly that wrong-context assumption because the input stage cannot know every place the value will later appear.
This sourceOWASP Cheat Sheet Series (n.d.). Requires encoding to match the actual output context and warns that one encoding strategy cannot safely cover HTML-body, attribute, and JavaScript uses.
- … mode is encoding for the wrong context: a value escaped for the HTML body and then dropped into a JavaScript or attribute context is a classic silent hole, and encoding "once, at input" bakes in exactly that wrong-context assumption because the input stage cannot know every place the value will later appear.
Verification¶
Does it exist? Not checked yet. This entry carries no identifier to resolve. It was extracted from the citation as written in the article, normalized, and deduplicated against the rest of the registry.
Does it back the claim? Read against the text for 1 of 2 citations: 1 supported. Each verdict is shown under its citation below, with what in the work backs the sentence.
Support is checked per citation rather than per work — the same source can be cited soundly in one article and wrongly in another. Per-citation recording began recently, so a citation with no recorded check is a gap in the record rather than evidence it went unchecked.
See how references were verified.
Registry ID ref:6567c58ad54f · see in the full table