Do I need to protect against XSS that is inserted in a GET request (I tried writing an alert(1) value to the page, but nothing happened)?

Question

XSS

Hello. I read on the internet that...

For example, this type of page http://yourdomain.ru/catalog?p=3could be a big hole in the site's security.
Similar to the actions done earlier in the input field, try to substitute the above lines of code into the parameter.

http://yourdomain.ru/catalog?p="><script>alert("cookie: "+document.cookie)

It is likely that you will receive the message again.

I tried to do it on my site, but I didn't get any message. And so, is it necessary to somehow handle GET parameters to protect against XSS or not?

Answer 1

You need to protect yourself if the value of this parameter will be inserted as it is in the html markup, your alert will work there. If it does not get into the markup, then it will not work. But there is no guarantee that during the development process someone will forget to sanitize your parameter, so you need to think about it at the moment when you receive data from the form or display parameters from the url.

Answer 2

You need to protect yourself at the WAF installation level (modules for nginx, for example). And this is necessary for units of a percentage of projects for certification.
And at the application level, it is enough to work correctly with the data.