Question 1

What is DOM-based XSS?

Accepted Answer

DOM-based XSS is a client-side injection flaw where JavaScript reads attacker-controllable data from a source like location.hash, document.URL, or referrer and writes it into a dangerous sink such as innerHTML, document.write, or eval. The payload never reaches the server, so server-side filters and WAFs never see it.

Question 2

Why doesn't a plain <script> tag work in innerHTML?

Accepted Answer

When you assign a string to innerHTML, the browser parses it but does not execute

Question 3

How do I prevent DOM-based XSS?

Accepted Answer

Write untrusted data with textContent or setAttribute instead of innerHTML, and if you must render HTML, pass it through a vetted sanitizer like DOMPurify with a strict allowlist. Add a Content-Security-Policy to block inline handlers and mark session cookies HttpOnly so injected script cannot read them.

DOM-Based XSS

Challenges

Frequently Asked Questions