I'm struggling with X-Script attacks. I think I understand what they are but it's unclear if they only affect public facing web pages (which I will define better).

The example I often see is where the attack is 'attached' to something public (such as a forum) where the user does not need to be logged in (and hence, a public facing web page). This means, as the page loads, the javascript loads and the attack can be performed.

My question is, can X-Script attacks still be dangerous if only the user who set's it can have access to it (if it's hidden behind a login)?

I am excluding SQL injection for this question please.

For example, consider a simple website that allows a user to login and see a list of comments they've made. They can't share their comments with anyone and only the logged in user can see the comments. The user can add any code they like here. As such, any malicious code they add will only affect that logged in user!

Do I still need to be concerned about X-script attacks on this type of website?


Users can already add any JavaScript they want to pages they view using tools available in their browser. As such you must always design your page so that this is not a problem.

Given the above, you might choose not to worry about script injection on a page like the one you describe. However, there are a lot of things to consider first (this is not an exhaustive list):

  • Can a malicious user craft a link that will add a script for whoever clicks it?
  • Are you sure the page will never be shown to anyone else? Do you have moderators, customer service, etc. who might need access in the future?
  • Might someone copy this solution to a page which does allow access by others?
  • What other holes are you leaving open by not fully sanitizing user input?

With this in mind, I would choose to protect myself against script injection any time it is not a requirement.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.