Cross-site Script Inclusion
Last updated
What is Cross-site Script Inclusion?
Cross-site script inclusion, also known as JSON vulnerability, can allow an attacker's website to read data from a JSON API. The attack works on older browsers by overriding built-in JavaScript object constructors, and then including an API URL using a <script> tag. Angular's HttpClient library recognizes this convention and automatically strips the string ")]}',\n" from all responses before further parsing.
Free resources to learn Cross-site Script Inclusion
- Official docsCross Site Script Inclusion
- ArticleXSSI Cross Site Script Inclusion
- ArticleTesting for Cross Site Script Inclusion
More in stage 18: Developer Tools
- Developer Tools
- Angular CLI
- DevTools
- Local Setup
- Language Service
- Deployment
- Libraries
- End-to-End Testing
- Using Libraries
- Schematics
- Creating Libraries
- Build Environments
- Cross-site Scripting
- HTTP Vulnerabilities
- CLI Builders
- Sanitization
- Cross-site Request Forgery
- AoT Compilation
- Trusting Safe Values
- HttpClient CSRF
- Enforce Trusted Types
- XSRF protection
- NGXS
- NgRx
- RxJS Interop
- Inputs as Signals
- Queries as Signals
- Model Inputs
Cross-site Script Inclusion: common questions
Can I learn Cross-site Script Inclusion in Hindi?
This lesson is written in English. Once you sign in, open it in the interactive course and ask the AI tutor to explain Cross-site Script Inclusion in Hindi or Hinglish. The tutor answers from this lesson’s own text, so it stays on the syllabus, and it runs on your own Google, OpenAI or Anthropic key.
Is this Cross-site Script Inclusion tutorial for beginners?
It is lesson 116 of 158 in the free Angular roadmap, in stage 18, Developer Tools. If you are new to Angular, start from stage 1 and come back here in order; if you already know the earlier stages, this lesson stands on its own.