What is XSS (Cross-Site Scripting)?

XSS (Cross-Site Scripting) is a vulnerability of web applications where an attacker injects malicious script (usually JavaScript) into content that is then executed in the browsers of other users. This allows stealing session cookies, impersonating user actions, redirecting to phishing sites, etc.

In Go applications, XSS is prevented by properly escaping user input when outputting to HTML, using templates with automatic escaping (e.g., html/template package), and applying Content Security Policy (CSP).

Example of safe output in Go:

import (
    "html/template"
    "net/http"
)

func handler(w http.ResponseWriter, r *http.Request) {
    t := template.Must(template.New("page").Parse(`<div>{{.}}</div>`))
    userInput := r.URL.Query().Get("input")
    t.Execute(w, userInput) // automatically escapes
}

Thus, malicious code will not be executed in the browser.