XSS scripts are executed by web browsers. Yet developers of web applications are asked to

solve and deal with XSS problems. Shouldn$$t that be the job of the browser developers

themselves? Make an argument for why application should deal with XSS and that it is not

simply a browser issue.

$2)$ What web$-$based attack is made harder to execute by adding a timeout value to authentication

tokens? Why does this help mitigate it but not completely solve the issue?

$3)$ Some people group XSS attacks with XSRF attacks, while others think they should be

considered separate. Make an argument that they are different and do this with an example of

an attack under each $($illustrating their differences$).$

$4)$ Suppose I want to do a XSS attack that executes through someone$$s

brower, but I know the server blacklists the string Dogs as well as the word script. Describe

at least two distinct ways to bypass this filter and describe the strings that do so$.$