XSS在现代浏览器中仍然可能

Question

I was curious, whether XSS is still possible today. I read a lot about browsers preventing it, but I seem I have missed something.

I tried a couple approaches myself, including the simplest ways, AJAX calls (luckily blocked by the browser) and viewing the content of an <iframe> and <frameset> , no success either way.

I read about DOM XSS, but that will only work, if the host has a page where it echoes content from the URL parameters.

Question:

Are modern browsers safe or are there any reasons why I should logout of every service I use before leaving a page?

Answer 1

whether XSS is still possible today.

Yes, it is.

will only work, if the host has a page where it echoes content from the URL parameters.

XSS is possible when any user input is output (either immediately (for a reflected attack) or later, possible to a different person (for a stored attack). That is what XSS is.

The Same Origin Policy (and related security features that prevent access to content on a different origin) has nothing to do with XSS.

Are modern browsers safe

XSS is a vulnerability in code provided by the server that takes user input and does something with it. There is no way to tell if user input is an XSS attack or a legitimate submission of data that includes live code. It has to be dealt with by server provided code since the input has to be treated with context sensitivity.