thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Foundational

Reflected Cross-Site Scripting

XSS in which a malicious script in a request is immediately echoed in the response without proper encoding.

Definition

The payload is usually delivered via a crafted link, so the victim must click it. It is non-persistent. Defenses include context-aware output encoding, auto-escaping templates, Content Security Policy and HttpOnly cookies to limit impact.

Example

A search page displays 'No results for <query>' without encoding the query.

Exam tip

Reflected = non-persistent and requires the victim to follow a link.

Related terms