tag
XSS
2 articles with this tag
2026-09-05
Choosing security headers: what is still needed, what is obsolete, and what does harm
More headers is not better. Sort them into three groups: still effective (CSP, HSTS, X-Frame-Options, nosniff, Referrer-Policy, Permissions-Policy), obsolete (Expect-CT has been mostly obsolete since June 2021), and actively harmful (MDN marks X-XSS-Protection deprecated and non-standard and warns it can create XSS vulnerabilities in otherwise safe sites). Copy a stale list and you import the harmful settings along with the good ones.
2026-06-08
What is XSS (Cross-Site Scripting): a flaw that runs an attacker's script in another user's browser
XSS makes an attacker-supplied string run 'as script' in another user's browser, leading directly to session theft and impersonation. The main defense is escaping on output. Don't disable your framework's auto-escaping.