XSS Defense Lab
A focused, safe simulation of how user input becomes browser-executed code, and how mature platforms stop it. Nothing here executes for real — this walks through the path an attack takes, not the attack itself.
A saved comment becomes code for the next viewer.
Run the vulnerable version first, then switch on Big Tech Mode to see the same payload blocked by layered defenses.
No simulation run yet.
The inspector will explain whether the payload executed, was blocked, or had its impact reduced.
Waiting for a run.
Rendering context will appear here.
Layers, not a single fix.
1. Encode and sanitize
Context-aware output escaping turns markup into inert text. HTML sanitizers strip scripts and dangerous attributes from anything that must stay rich text — the first and most direct line of defense.
2. Constrain the browser
Content Security Policy blocks inline and unauthorized scripts even if a payload slips through. Trusted Types stop unapproved values from ever reaching a sink like innerHTML.
3. Limit the blast radius
HttpOnly keeps session cookies out of reach of JavaScript entirely. SameSite reduces what a cross-site request can do with them. Neither stops the injection — both shrink what it's worth.
This lab is a simulation: payloads are analyzed and described, never executed. No script runs, no request leaves the page, and no data is collected.