The Culprit Who Stole My Cookies Was a Comment (XSS Defense Guide)
내 쿠키를 훔쳐간 범인은 게시판 댓글이었다 (XSS 방어 가이드)
My admin account was hijacked because of a single comment on the board. I dive deep into the 3 types of XSS (Stored, Reflected, DOM) and concrete defense strategies in React/Next.js environments, including HTML Escaping, CSP, and Cookie Security.
c
codemapo
INTERDISCIPLINARY DEV · SEOUL
10. Conclusion: "Trust No One"
XSS is the oldest trick in the book, but it's still in the Top 3.
The logic is simple:
Input Validation: Ensure data looks like what you expect.
Output Escaping: Ensure data is treated as text, not code.
CSP: Even if 1 and 2 fail, stop the execution.
Don't let your "safe" React app be the one that leaks 10,000 user accounts because of one unchecked href.