XSS

Meaning

XSS, or cross-site scripting, is an attack in which untrusted script runs inside a trusted page and acts with that page's privileges. MDN describes it as getting a target site to execute malicious code as though it were part of the site. For cookies it matters because script can read any cookie that is not HttpOnly, and can still send authenticated requests even when it cannot read the cookie. The real fix is preventing injection by encoding output, using a content security policy and keeping libraries current. See also: HttpOnly, CSRF, Session fixation, the guide "Cookies, CSRF, XSS and Privacy Consent Basics".