What is Cross-Site Scripting (XSS) and why is it called a "confused deputy" attack?
XSS injects attacker JavaScript into a trusted page; it's a "confused deputy" because the victim's browser runs that script with the victim's own privileges, trusting it because it came from the legitimate site.
Cross-Site Scripting (XSS):
- Exploits a flaw in a web application to inject malicious code — in practice, JavaScript
- The script runs on the user's client, typically the browser; the server is only the delivery vehicle, which is why XSS can hurt users of an otherwise perfectly healthy server
- Typical payoff: read cookies and session tokens, or simply act as the user — change their e-mail, transfer money, post as them
Confused deputy — the general pattern: a deputy is any component that holds authority on someone else's behalf. A confused-deputy attack never steals that authority; it tricks the deputy into using its own legitimate privileges for the attacker's purpose.
Applied here, the browser is the deputy:
- It holds the victim's authority for that site — the session cookie, the logged-in state, whatever the page can reach
- It decides what a script may do by the origin of the document it runs in, not by what the script does — or even by where the script file was fetched from, since a
<script src>pulled off a CDN still runs with the embedding page's privileges. Script running in a page onbank.exampleis trusted withbank.example's data; that is the same-origin policy working exactly as designed - The attacker's script did arrive from
bank.example— it was smuggled in through unescaped input — so the browser cannot tell it apart from the site's own code and runs it with the victim's privileges
So the lesson is about attribution, not privilege: the browser has no way to know which characters in a page the developer wrote and which an attacker supplied. Only the server can keep them apart — by encoding untrusted data on output so it can never become script in the first place.
Go deeper:
PortSwigger — Cross-site scripting — definition, impact, the three XSS types, with labs.- Wikipedia — Confused deputy problem — the general pattern, from the original compiler example to XSS and CSRF.