Prevent XSS attacks
Demonstrate an XSS exploit on real code, then fix it by escaping output at the correct layer and adding a CSP header as defence in depth.
Preview
Copy prompt
The following code is vulnerable to cross-site scripting: [Paste code]. Construct and explain a concrete XSS payload — both stored and reflected variants if applicable — that successfully executes JavaScript using the current code. Fix the vulnerability by applying output encoding or escaping at the correct layer for each context (HTML body, attributes, JavaScript, URL). Add a Content Security Policy header as a defence-in-depth measure that would limit the damage even if an XSS payload were somehow injected.
More
Security
Prompts
