Client-side cross-site scripting protection

摘要: Web applications are becoming the dominant way to provide access online services. At same time, web application vulnerabilities being discovered and disclosed at an alarming rate. often make use of JavaScript code that is embedded into pages support dynamic client-side behavior. This script executed in context user's browser. To protect environment from malicious code, browsers a sand-boxing mechanism limits only resources associated with its origin site. Unfortunately, these security mechanisms fail if user can be lured downloading intermediate, trusted In this case, granted full all (e.g., authentication tokens cookies) belong Such attacks called cross-site scripting (XSS) attacks. general, XSS easy execute, but difficult detect prevent. One reason high flexibility HTML encoding schemes, offering attacker many possibilities for circumventing server-side input filters should prevent scripts injected sites. Also, devising solution not because difficulty identifying as malicious. paper presents Noxes, which is, best our knowledge, first mitigate Noxes acts proxy uses both manual automatically generated rules possible attempts. effectively protects against information leakage while requiring minimal interaction customization effort.