XSS ataki: zaschita veb-prilozheniy

Cross-Site Scripting (XSS) — vnedrenie JavaScript-koda v stranitsy, prosmatrivaemye drugimi polzovatelyami.

Tipy XSS

• Stored XSS: Vredonosnyy kod sohranyaetsya v BD
• Reflected XSS: Kod peredayotsya cherez URL/formu
• DOM-based XSS: Uyazvimost v klientskom JavaScript

Zaschita v Laravel

Blade avtomaticheski ekraniruet vyvod:

{{ $user->name }}  // Ekranirovannyy vyvod{!! $user->bio !!}  // Syroy HTML — ostorozhno!

Content Security Policy (CSP)

CSP predotvraschaet vypolnenie inline-skriptov:

Content-Security-Policy:     default-src 'self';     script-src 'self' 'nonce-{random}';     style-src 'self' 'unsafe-inline';

HttpOnly Cookies

Zaschita session hijacking:

Set-Cookie: sessionid=xxx; HttpOnly; Secure; SameSite=Strict

Zaschita v React/Vue

Freymvorki avtomaticheski ekraniruyut:

// React — avtomaticheski ekraniruet
{userInput}

// Opasno — dangerouslySetInnerHTML