XSS vulnerability prevention (three suggestions for developers and users)

 

XSS attacks and their terrible nature and flexibility are favored by hackers. For XSS attacks, the editor provides the following security suggestions to common WEB users and WEB application developers:

 

Web User

 

1. Be extremely careful when you click a link in an email or instant messaging software: Pay attention to suspicious long links, especially those that seem to contain HTML code. If you have doubts about it, You can manually enter the domain name in the browser address bar, And Then browse the information you want through the link on the page.

 

2. No web browser has obvious security advantages for XSS vulnerabilities. Firefox is also insecure. For more security, you can install some browser plug-ins, such as Firefox's NoScript or Netcraft toolbar.

 

3. There is no "100% valid" in the world ". Avoid accessing problematic websites, such as websites that provide hack information and tools, crack software, and adult photos. These types of websites exploit browser vulnerabilities and endanger the operating system.

 

Web application developers

 

1. Developers should first focus on reliable input verification for content submitted by all users. The submitted content includes URL, query keyword, http header, and post data. Only Accept the characters you want within the length range specified by you, in the appropriate format. Block, filter, or ignore anything else.

 

2. Protect all sensitive functions to prevent bots from being automated or executed by third-party websites. Implements session tokens, CAPTCHA system, or HTTP reference header check.

 

3. If your web application must support HTML provided by the user, the security of the application will be disastrous. However, you can do something to protect the web site: Make sure that the HTML content you receive is properly formatted and only contains the minimal and secure tag (no JavaScript ), remove any reference to remote content (especially style sheets and JavaScript ). For more security, use httpOnly cookies.