What should be header response of XSS vulnerability upon form submission?

Question

We have a PHP web application and all of the user inputs are sanitized. We tested it within Burp tool and found no XSS vulnerabilities.

One of our security adviser tells us that when you type down any script within user input such as <script>alert("Pop")</script> and it gives 200 header response then that means XSS vulnerability presents. Header response should be 4xx or 5xx but I am having doubt. In above scenario, we removed such code from user input and stored remaining information within database by sending back 200 response.

Please let me know what could be response header when you found some XSS vulnerable scripts within user input upon form submission.

Answer 1

The HTTP response code is unrelated to the existence of an XSS. If you get a 200 (status ok) while trying an XSS then it could be that the XSS was actually successful or that the XSS does not work because the server has sufficiently sanitized the data.

Similar a code of 4xx, 5xx etc could happen without a successful XSS, for example if a web application firewall in front of the server has detected something which seems to look like an XSS and has blocked it before it even reaches the server. But this does not mean that the XSS attempt would have actually been successful against the web application.