title: IE8 XSS filter: what does it really do?
body: <p>Internet Explorer 8 has a new security feature, an <a href="http://msdn.microsoft.com/en-us/library/dd565647%28VS.85%29.aspx" rel="noreferrer">XSS filter</a> that tries to intercept cross-site scripting attempts.    It's described this way:</p>
  
  <blockquote>
    <p>The XSS Filter, a feature new to Internet Explorer 8, detects JavaScript in URL and HTTP POST requests. If JavaScript is detected, the XSS Filter searches evidence of reflection, information that would be returned to the attacking Web site if the attacking request were submitted unchanged. If reflection is detected, the XSS Filter sanitizes the original request so that the additional JavaScript cannot be executed.</p>
  </blockquote>
  
  <p>I'm finding that the XSS filter kicks in even when there's no "evidence of reflection", and am starting to think that the filter simply notices when a request is made to another site and the response contains JavaScript.</p>
  
  <p>But even that is hard to verify because the effect seems to come and go.  IE has different zones, and just when I think I've reproduced the problem, the filter doesn't kick in anymore, and I don't know why.</p>
  
  <p>Anyone have any tips on how to combat this?  What is the filter really looking for?  Is there any way for a good-guy to POST data to a 3rd-party site which can return HTML to be displayed in an iframe and not trigger the filter?</p>
  
  <p>Background: I'm loading a JavaScript library from a 3rd-party site.  That JavaScript harvests some data from the current HTML page, and posts it to the 3rd-party site, which responds with some HTML to be displayed in an iframe.  To see it in action, visit an <a href="http://recipe.aol.com/recipe/oatmeal-butter-cookies/142275" rel="noreferrer">AOL Food</a> page and click the "Print" icon just above the story.</p>