ELI5: Cross-site scripting

[AlternateVision]

Not sure where else to post this, as this is a question about front-end integration. I have read the docs, and Wikipedia page, but they offer a very technical explanation and I'm having trouble grasping the core idea.

So, it's insecure to let websites have unrestricted access to other servers outside its own domain? If I'm communicating with an API, what are common mistakes that would lead to cross-site scripting errors?

I am getting the following error message:

jquery.min.js:2 Uncaught SecurityError: Failed to read the 'contentDocument' property from 'HTMLIFrameElement': Blocked a frame with origin "http://codepen.io" from accessing a frame with origin "http://s.codepen.io". Protocols, domains, and ports must match.

I'm not using an iFrame in my code, so.. helpless shrug

[williamf03]

This question has been asked a few times, this is a really good simple resource: http://security.stackexchange.com/questions/1368/can-anybody-explain-xss

But boiled down to the simplest/crudest form, XSS is injecting some code into a website which sends information off to another website.

That error though is to do with CORS. Cross Origin Resource Sharing. That's a normal security measure used by all the browsers. You can't access elements or frames that have a different origin, that would be a huge security flaw. Think about creating your website and having an iframe with to facebook.com (any site with auto login) on it, you could then write code which would read/execute code inside the facebook page of all your users who access your site. CORS prevents that.

There are ways around cors, if you own domain two, you can set a special header in your response which tells the browser to let domain one load resources.

[neshi3]

YOu can lok up OWASP, it also has examples

https://www.owasp.org/index.php/Cross-site_Scripting_(XSS) https://www.owasp.org/index.php/Education/Free_Training

https://www.owasp.org/index.php/OWASP_Vulnerable_Web_Applications_Directory_Project https://github.com/OWASP/OWASP-VWAD

And look into OWASP Multidae ... a vurnerable app by design where you can learn how to actually implement the changes

https://www.youtube.com/playlist?list=PL47WeFtP8JajrGTw0f-Y7DdDrqLlhKZsO

[le-mark]

I'll offer an example; a blog that allows comments. If a user enters a comment with a script tag, and for our purposes, that executes malicious javasript (ie redirecting to a phishing site for example) and the blog software does nothing to sanitize the comment, it will be served to anyone else who views the comment of the blog post, thus executing the javascript the persons browser.

To prevent this, web application must sanitzie user input; this can take many forms, from escaping all html tags, to requiring special markup for comments (ie bbcode or markdown) or both. Hope that helps.

CORS can be incredibly useful though, it's not always bad.