tag
XSS
2 articles with this tag
2026-09-05
Security headers are not a list to stack — what still works, what is obsolete, and what now does harm
More headers is not better. Sort them into three groups: still effective (CSP, HSTS, X-Frame-Options, nosniff, Referrer-Policy, Permissions-Policy), obsolete (Expect-CT has been mostly obsolete since June 2021), and actively harmful (MDN marks X-XSS-Protection deprecated and non-standard and warns it can create XSS vulnerabilities in otherwise safe sites). Copy a stale list and you import the harmful settings along with the good ones.
2026-06-08
What is XSS (Cross-Site Scripting) — code running in someone else's browser
XSS makes an attacker-supplied string run 'as script' in another user's browser — straight to session theft and impersonation. The real defense is escaping on output. Don't disable your framework's auto-escaping.