Web Security · Junior · Question 19 of 75

What is DOM-based XSS?

✓Correct answer: Client-side code takes data from a source like location.hash and writes it into a dangerous sink like innerHTML
2An attack that deletes DOM nodes from the page
3XSS that only happens in server-side rendered pages

Explanation

The server may never see the payload: everything happens in the browser's own JavaScript. That's why DOM XSS needs reviews of front-end code.

Further reading

Test yourself

Take the Web Security · Junior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.