08. Cross-Site Scripting (XSS): Stored, Reflected, DOM-based & Content Security Policy (CSP) • Git, System Design & Web Security (OWASP Top 10) • Rishabh Ki Kaksha

Git, System Design & Web Security (OWASP Top 10) › 08. Cross-Site Scripting (XSS): Stored, Reflected, DOM-based & Content Security Policy (CSP)

45 mins

← Prev Next →

Course Syllabus

Module 1: Git Internals, Plumbing Commands & DAG Graph Architecture

01. Git Internals: Blobs, Trees, Commits & Annotated Tags (The .git Directory Anatomy) 02. Git DAG (Directed Acyclic Graph) & Plumbing Commands (cat-file, hash-object, write-tree) 03. Git Three Trees Architecture: Working Directory, Staging Index & HEAD

Part 1: Git Mastery, Security Defense & Caching

Module 2: Advanced Branching Strategies & Disaster Recovery

04. Advanced Rebasing: Interactive Rebase (squash, edit, fixup) vs Merge 05. Git Disaster Recovery: git reflog, Cherry-Pick & Recovering Deleted Commits/Branches 06. Enterprise Branching: Trunk-Based Development vs GitFlow vs Feature Flag Architecture

Module 3: Web Application Security: OWASP Top 10 Defenses

07. OWASP #1 & #3: SQL Injection (SQLi) & Server-Side Request Forgery (SSRF) Hardening 08. Cross-Site Scripting (XSS): Stored, Reflected, DOM-based & Content Security Policy (CSP) 09. CSRF vs Cross-Origin Traps: SameSite Cookies, Anti-CSRF Tokens & CORS Preflight Rules 10. Broken Object-Level Authorization (BOLA/IDOR) & Role-Based Access Control (RBAC/ABAC)

Module 4: Cryptography, PKI, SSL/TLS & Mutual Auth (mTLS)

11. Asymmetric Cryptography (RSA vs ECC) & Digital Signatures with GPG Keys 12. Public Key Infrastructure (PKI), TLS 1.3 Handshake & Let's Encrypt Automation 13. Mutual TLS (mTLS) for Zero-Trust Service-to-Service Communication

Module 5: DevSecOps, Secret Scanning & Zero-Trust Security Architecture

14. Automated Secret Scanning (Gitleaks, Trufflehog) & Git Pre-Commit Hooks 15. Software Supply Chain Security: Dependabot, SBOM (Software Bill of Materials) & Signed Commits 16. Enterprise Zero-Trust Architecture: Cloud IAM, Bastion Hosts & WireGuard VPN Networks

Interactive Lesson Studio

# 08. Cross-Site Scripting (XSS): Stored, Reflected, DOM-based & Content Security Policy (CSP)

> Git & Web Security Notes by Rishabh - Topic 08

---

### 1. The 3 Types of XSS Attacks 🎭

1. **Stored (Persistent) XSS:** Malicious `<script>` database me save ho jata hai (e.g. comment field); har visitor ke browser me execute hota hai!
2. **Reflected (Non-Persistent) XSS:** URL search query me inject hota hai (`https://site.com/search?q=<script>...`).
3. **DOM-Based XSS:** Client-side JavaScript sink me unsafe data jata hai (`element.innerHTML = location.hash`).

---

### 2. Content Security Policy (CSP): The Ultimate Browser Firewall 🛡️

HTTP Header jo browser ko batata hai ki kaunse domain se JavaScript run ho sakti hai:

```http
Content-Security-Policy: default-src 'self'; script-src 'self' 'nonce-rAnd0m123' https://apis.google.com; object-src 'none'; base-uri 'self';
```

---

### 3. Safe DOM Manipulation in React / Vanilla JS

```typescript
// ❌ DANGEROUS SINK:
document.getElementById("user-bio").innerHTML = userInput;
<div dangerouslySetInnerHTML={{ __html: userInput }} /> // ⚠️ Unless sanitized with DOMPurify!

// ✅ SAFE SINK:
document.getElementById("user-bio").textContent = userInput; // Auto-escaped by browser!

// ✅ Sanitization when HTML is required:
import DOMPurify from "isomorphic-dompurify";
const cleanHtml = DOMPurify.sanitize(dirtyHtml);
```

---

### 4. Master Comparison Matrix

---

### 5. Interview Ke 3 Sawal Is Topic Se

1. **`httpOnly` cookie flag XSS attack me account takeover ko kaise rokta hai?** -> `document.cookie` JavaScript API ko disable kar deta hai jisse injected XSS script session token chura nahi sakti.
2. **CSP Nonce kya hota hai?** -> Server har request par ek unique random cryptographic string (`nonce`) generate karta hai; browser sirf unhi `<script nonce="...">` tags ko execute karta hai jinka nonce match hota hai.
3. **Markdown rendering me XSS kaise prevent kiya jata hai?** -> Markdown parser ke output ko `rehype-sanitize` ya `DOMPurify` pipeline se pass karke `<script>`, `onerror`, `onload` attributes strip karke.

---
**Next Topic:** 09. CSRF vs Cross-Origin Traps: SameSite Cookies, Anti-CSRF Tokens & CORS Preflight Rules

Loading lesson content...

Python 3.12

Full IDE

Live Execution Terminal

Click "Execute Live" to run code.
                

Lesson Mastery AI Quiz

AI Doubt Solver

CERTIFICATE OF COMPLETION

Rishabh Gehlot

PHP 8+ & Laravel 11 Master Track