Moving target defense against cross-site scripting

A client device configured to implement a moving target defense against cross-site scripting, the client device comprising:

• a processor;
• and
• memory storing instructions that, when executed, cause the processor to:
• request a web page from a server, wherein the server mutates web content with JavaScript offline to provide N versions of the web page, each with a different mutated version of JavaScript, and wherein, upon the requesting, the server provides one of the N versions of the web page thereby providing the moving target defense against cross-site scripting;
• receive a response serving the web page from the server with a header comprising an indication of a mutated version of JavaScript for the web page of the N versions of the web page each with a different mutated version and replaced periodically to increase probability of vulnerability detection, wherein the mutated version of JavaScript comprises changes to one or more lexical tokens which are selected based on use in malicious JavaScript attacks, wherein the one or more lexical tokens are one or more of a left parenthesis and an assignment operator, wherein cross-site scripting requires use of the parenthesis or the assignment operator to maliciously manipulate behavior, and wherein the parenthesis or the assignment operator are randomized because they manipulate behavior or state in a cross-site scripting attack, and wherein the web page is randomly reselected from the N versions and replaced periodically by the server;
• adjust a JavaScript interpreter based on the mutated version of JavaScript for the web page;
• and
• detect any JavaScript not conforming to the mutated version of JavaScript and provide an indication of a violation including JavaScript not conforming to the mutated version of JavaScript associated with the web page, wherein the indication includes a page on which the violation occurred, the page's referrer, a resource that violated the page's policy, and a specific directive of the violation.