XSS Prevention

Summary

Cross-Site Scripting — preventing attacker-controlled scripts from being injected into pages your API's data ends up rendered on, primarily by escaping/sanitizing output on the frontend, but also validating input on the backend.

• 1Learn how stored XSS (malicious data saved to your DB) differs from reflected XSS.
• 2Sanitize or reject HTML/script content in user-submitted text fields.
• 3Understand the backend's role is defense-in-depth — the frontend must also escape output correctly.