Cross-Site Scripting (XSS)

XSS lets an attacker's script execute in the context of a victim's authenticated session — reading cookies, submitting forms, or exfiltrating data as if it were the real user acting.

Try this attack in the Playground

Reflected, stored, and DOM-based XSS all boil down to unescaped user input reaching the DOM as markup

Output encoding converts <script> into <script> so it renders as visible text, not executable code

A strict Content-Security-Policy blocks inline scripts even if encoding is somehow missed

HttpOnly cookies mean even a successful XSS payload can't read the session token via document.cookie

Want this flow explained in detail as it plays?

POST/api/comments

Headers

Host:app.flowground.dev

Content-Type:application/json

Body

Stuck? Try a hint

Defense in depth

Revealed once you've worked through the hint ladder above — try the attack yourself first.

Vulnerable vs. Fixed

// DO NOT DO THIS
function Comment({ text }: { text: string }) {
  return <div dangerouslySetInnerHTML={{ __html: text }} />;
}