Cross site scripting attack, also called XSS attack, is one of the most serious risks in Web security. With the widespread use of Web technologies such as Web services, APIs, and the emergence of new programming styles such as AJAX, CSS and HTML5, the threat of XSS attacks has become more serious. Therefore, how to deal with the security risk of XSS attacks has become an important concern in Web security research. By investigating the literature on XSS attack detection and defence in recent years, this paper reviewed the latest techniques for XSS attack detection and defence from both non-adversarial and adversarial perspectives, based on whether the XSS attack was stealthy or not. Firstly, from the aspects of non-confrontational attack detection and confrontational attack detection, this paper explored and analysed the methods of learning attack features from data and predicting attacks based on machine learning and optimising the detection model based on reinforcement learning to identify or generate confrontational sample strategies. Secondly, it elaborated the methods of non-confrontational attack defence to filter the XSS attacks based on rules, to reduce the success rate of attacks based on the randomness of the moving targets defence(MTD), and to isolation sandbox-based approach to prevent the propagation of XSS attacks. Finally, this paper presented the future issues to be considered and outlooks of XSS attack detection and defence in terms of sample characteristics, model features and limitations of CSP, and the wide range of uploading functions, respectively.

[2023-11-14] Accepted Paper /doc/2023.06.0286/v1

[2024-03-05] Printed Article /doc/2023.06.0286/v2