Cross Site Scripting Prevention Cheat Sheet¶
OWASP Foundation. (2021). Cross Site Scripting Prevention Cheat Sheet.
Cited by¶
1 citation across 1 artifact.
Each citation links to the sentence it supports in the citing article.
Domain-specific¶
- Cross-Site Scripting
- The intervention family therefore requires context-aware output encoding matched to the sink — HTML encoding for HTML text and attribute contexts, JavaScript string escaping for script contexts, URL encoding for href values — plus a Content Security Policy header to cap what scripts the page is permitted to execute even if an injection slips through, Trusted Types to restrict which code may write to dangerous DOM sinks, and cookie flags (HttpOnly, Secure, SameSite) to limit what a successful payload can steal
This sourcePrescribes exactly this per-sink encoding scheme (HTML text, HTML attribute, JavaScript string, CSS, URL) and treats CSP, Trusted Types and the cookie flags as defence-in-depth layers rather than the primary remedy.
- The intervention family therefore requires context-aware output encoding matched to the sink — HTML encoding for HTML text and attribute contexts, JavaScript string escaping for script contexts, URL encoding for href values — plus a Content Security Policy header to cap what scripts the page is permitted to execute even if an injection slips through, Trusted Types to restrict which code may write to dangerous DOM sinks, and cookie flags (HttpOnly, Secure, SameSite) to limit what a successful payload can steal
Verification¶
This reference passed the adversarial substantiation pipeline: it was checked to exist and to support the claim it is attached to. See how references were verified.
Registry ID ref:6567c58ad54f · see in the full table