StackScholar

Security

XSS

Injecting script into a page so it runs with the site's origin and privileges.

Why interviewers ask about it

Context-aware output escaping is the fix, not input filtering. Django templates and Flask's Jinja2 setup autoescape by default - so the risk lives in |safe and dangerouslySetInnerHTML.

Related terms

CSRF

Tricking a logged-in user's browser into making an unintended state-changing request.

Cookie vs localStorage

Cookies are sent automatically with matching requests and can be HttpOnly; localStorage is script-only and never transmitted.

This term is part of the free Python Full-Stack interview preparation module - browse the full glossary for every definition.