Best Practices to Eradicate Cross Site Scripting
Cross-site scripting (XSS) occurs when hackers place client-side script into the computers of vulnerable parties. According to BusinessWeek, this is one of the most common types of malicious computer attacks today. This type of attack occurs across the Internet and allows perpetrators to view – and steal – sensitive information. Fortunately, there are a number of best practices that can prevent or at least lower the incidence of XSS.
Web browser’s options
According to IBM, the person who is browsing the web has several options to help prevent XSS. Unfortunately each has its downside. First, a user can only utilize links from the main Web site. This will lower their chances of this vulnerability, but may complicate the browsing experience.
The second option is to disable scripting languages. One would need to do this in the Web browser and in the HTML-enabled e-mail client. This will shield the individual more from XSS attacks, but will hamper a great deal of functionality.
Encoding
You can encode your web pages to avoid incidences of XSS. The web server should make sure that the scripts are not inadvertently executed. This involves incorporating an encoding function that replaces scripting tags with specific codes. Drawbacks of this method are that it can hamper performance of the website and use up a great deal of resources.
Filtering
Filtering involves the specific filtration of metacharacters. The system will look at every input field. If suspicious script tags are found, they will not be allowed to pass through to the user. This does not always work well because characters may be mistakenly labeled as special. Also, XSS can still occur because the scripts may not be recognized as input if they do not come in as HTML. Filtering can also be performed upon output. Though not foolproof, it can help cut down on the incidence of XSS.
Security related to cookies
Sometimes the perpetrator wants to gain access by stealing cookies. Some web applications attach session cookies to the original user’s IP address. This can be effective in some cases, but may fail if an attacker manipulates his IP address to appear different or uses the same web proxy/NATed IP address. In addition, he will also still be able to access information and manipulate the website.
No matter whether you are on a personal computer or working in a large business, you can be affected by XSS. Best practices can help to lower the incidence of this all too common vulnerability.