Cross Site Scripting Joy

Wednesday, December 5. 2007

Cross Site Scripting Joy

Google for ‘cross site scripting‘ and you’ll get a plethora of articles and tutorials about vulnerabilities, loopholes, and exploits. Early in the development of JavaScript it was realised that client-side scripting had the capacity to access information in other browser windows that might be sensitive and which it certainly had no business reading. This was considered a problem and dubbed cross site scripting (thankfully abbreviated to XSS, not CSS). The basic security principle that solves this is the Same Origin Policy, which prevents scripts from accessing resources unless they come from the same host. Sounds simple enough, but modern XSS exploits are incredibly complex, getting around the same origin policy by taking advantage of opportunities to inject script into websites that simply redisplay input without encoding it first.