XSS
XSS Types
| Type | Description |
|---|---|
| Stored | Malicious script stored in DB, served to users |
| Reflected | Script in URL, reflected in response |
| DOM-based | Script runs in browser DOM |
Prevention
// 1. Output encoding
String safe = HtmlUtils.htmlEscape(userInput);
// 2. Content Security Policy header
response.setHeader("Content-Security-Policy", "default-src 'self'");
// 3. HttpOnly cookies (prevent session theft)
Key Points
- Understanding Cross-Site Scripting (XSS) is essential for production systems
- Always consider scalability and maintainability
- Test thoroughly before deploying to production
- Monitor performance and set up alerting
Common Patterns
- Validation: Always validate input at the boundary
- Error Handling: Use structured error responses
- Logging: Log key events for debugging
- Testing: Unit, integration, and load tests
- Documentation: Keep docs updated with code changes
Best Practices
Key Principles
- Follow SOLID principles
- Write clean, readable code
- Test thoroughly
- Document decisions
- Monitor in production
Implementation
- Start simple, refactor as needed
- Use established patterns
- Consider trade-offs
- Review with peers
Continuous Improvement
- Learn from incidents
- Update documentation
- Share knowledge
- Mentor others
Key Points
- Understanding Cross-Site Scripting (XSS) is essential for production systems
- Always consider scalability and maintainability
- Test thoroughly before deploying to production
- Monitor performance and set up alerting
Common Patterns
- Validation: Always validate input at the boundary
- Error Handling: Use structured error responses
- Logging: Log key events for debugging
- Testing: Unit, integration, and load tests
- Documentation: Keep docs updated with code changes
Practice Problems
Design and implement a solution for Cross-Site Scripting (XSS) in a backend system. Consider scalability, error handling, and production readiness.
Solution
// Cross-Site Scripting (XSS) implementation
// Key aspects: validation, error handling, logging, testing
public class CrossSiteScriptingXSS {
// Production-ready implementation
}Identify and handle edge cases for Cross-Site Scripting (XSS). What happens under high load, with invalid input, or during failures?
Solution
// Edge case handling:
// 1. Null/empty input -> validation
// 2. High load -> rate limiting, queuing
// 3. Failures -> retries, circuit breaker
// 4. Concurrent access -> locks, idempotencyWrite a testing strategy for Cross-Site Scripting (XSS). Include unit tests, integration tests, and performance tests.
Solution
// Test plan:
// - Unit: 80% coverage target
// - Integration: API contracts
// - Performance: latency, throughput
// - Chaos: failure injectionQuiz
1. Which XSS stores script in database?
2. Prevent XSS with?
3. What is the primary purpose of Cross-Site Scripting (XSS)?
4. What is a common mistake when implementing Cross-Site Scripting (XSS)?
Flashcards
Question
XSS types?
Click to reveal answer
Answer
Stored, Reflected, DOM-based
Question
XSS prevention?
Click to reveal answer
Answer
Output encoding, CSP headers, HttpOnly cookies
Question
What is Cross-Site Scripting (XSS)?
Click to reveal answer
Answer
Cross-Site Scripting (XSS) is a key concept in backend development.
Question
When to use Cross-Site Scripting (XSS)?
Click to reveal answer
Answer
Use Cross-Site Scripting (XSS) when building production systems that require reliability, scalability, and maintainability.
Question
Cross-Site Scripting (XSS) best practices
Click to reveal answer
Answer
Follow SOLID principles, write clean code, test thoroughly, document decisions, and monitor in production.
Revision Notes
Key Takeaways
- 1.XSS injects scripts into web pages
- 2.Stored, Reflected, DOM-based types
- 3.Prevent: output encoding, CSP, HttpOnly cookies
Interview Tips
- •Know XSS types and prevention
- •Implement CSP headers
Cheat Sheet
XSS
- Types: Stored, Reflected, DOM-based
- Prevent: output encoding (htmlEscape)
- CSP header: Content-Security-Policy
- HttpOnly cookies