Skip to content
CyberLens AI

Security guide

How to fix cross-site scripting (XSS) vulnerabilities

Published by CyberLens AI. Last updated .

Cross-site scripting (XSS) lets attackers inject scripts into pages seen by other users — stealing sessions, hijacking accounts, and redirecting to phishing pages without any server-side access.

AI-generated code is especially prone to XSS because LLMs commonly skip output encoding. This guide covers five practical steps: mapping injection surfaces, applying output encoding, sanitizing rich HTML with DOMPurify, adding a Content Security Policy, and scanning to verify.

Scan your site for free Browse all guides

Map your injection surfaces

Identify every place user-controlled data reaches the browser before applying fixes.

  • innerHTML and outerHTML writes from user input
  • URL query parameters and fragments rendered in the DOM
  • Template literals and document.write() calls
  • dangerouslySetInnerHTML in React without a sanitizer
  • eval() and similar dynamic code execution on user strings

Apply output encoding and sanitize rich HTML

React JSX escapes string children automatically but dangerouslySetInnerHTML does not. Use textContent instead of innerHTML in vanilla JS, and wrap rich HTML with DOMPurify.

  • Replace innerHTML with textContent for plain text values
  • Sanitize user-supplied HTML with DOMPurify before rendering
  • Never call eval() or new Function() on user-supplied strings
  • Validate and encode URL parameters before inserting into the DOM

Add a Content Security Policy header

A CSP header restricts which scripts the browser can run, limiting XSS blast radius even if encoding gaps remain.

  • Set Content-Security-Policy: default-src 'self'; script-src 'self'
  • Use helmet in Express or vercel.json headers for Vercel deployments
  • Block inline scripts and eval with script-src 'self'
  • Set frame-ancestors 'none' to prevent clickjacking alongside XSS

Scan and verify the fix

Run an automated scan after making changes to confirm headers are in place and test common XSS payloads in your inputs.

  • Submit XSS test payloads in all input fields and URL parameters
  • Verify Content-Security-Policy is present in HTTP response headers
  • Use CyberLens AI to scan deployed sites for missing security headers
  • Re-scan after each configuration change

Questions and answers

What is the difference between stored, reflected, and DOM-based XSS?

Stored XSS saves malicious scripts to a database and runs them for every user who views the page. Reflected XSS injects via a URL parameter and reflects immediately in the response. DOM-based XSS happens entirely in the browser when JavaScript reads and writes user-controlled data to the DOM without encoding.

Does React protect against XSS automatically?

React escapes string values rendered through JSX, preventing most reflected and stored XSS. However, dangerouslySetInnerHTML bypasses this protection entirely, and eval() or document.write() calls in your JavaScript are still unsafe. Add a Content Security Policy header as a defence-in-depth layer.

Is a Content Security Policy enough to prevent XSS on its own?

No. CSP is a defence-in-depth control that limits damage if an attacker injects a script. The primary fix is correct output encoding at every injection surface. CSP acts as a safety net but should not be used instead of proper encoding.

Can AI-generated code have XSS vulnerabilities?

Yes. AI assistants commonly produce code that renders user input with innerHTML, skips output encoding in template literals, or uses dangerouslySetInnerHTML without a sanitizer. Always review AI-generated front-end code for these patterns before shipping.

How do I test if my XSS fix worked?

Submit common XSS test strings in every input field and URL parameter — such as angle-bracket script tags with alert() calls and img onerror handlers. Also run an automated scanner: CyberLens AI checks for missing security headers including Content-Security-Policy and confirms your header configuration from outside your network.

Security references

CyberLens AI guidance is informed by established security standards and public vulnerability intelligence.