Cross-Site Scripting (XSS) Attacks
Cross-Site Scripting (XSS) allows attackers to inject malicious scripts into web pages viewed by other users. These scripts run with the site's privileges, enabling cookie theft, session hijacking, or UI defacement. There are three main types: Stored, Reflected, and DOM-based.
The attacker writes a dangerous note (script) and tricks the website into delivering it to other users. When the victim reads the note in their browser, the script executes as if it came from the trusted site.
1Types of XSS Attacks
XSS attacks are classified into three main types based on how the malicious payload is delivered and executed. Understanding each type helps choose the right prevention strategy.
2Stored XSS (Persistent)
The most dangerous type. Attacker submits malicious script that gets permanently stored on the server (e.g., in a comment or profile). Every user who views the page executes the script.
3Reflected XSS (Non-Persistent)
Malicious script is reflected back in the server's immediate response, usually via a crafted URL. Requires social engineering (phishing link) to trick the victim.
4DOM-based XSS
Occurs entirely on the client side. Attacker manipulates the URL or other client-side data, and vulnerable JavaScript inserts it into the DOM without proper sanitization.
5XSS Prevention Layers (Defense in Depth)
Never rely on a single layer. Use multiple overlapping protections to stop attacks even if one layer fails.
| Property | Stored XSS | Reflected XSS | DOM-based XSS |
|---|---|---|---|
| Impact | Affects all users | Targeted via phishing | No server involvement |
| Example | Comment form without sanitization | Search query reflected in page | Reading location.hash and using innerHTML |
| Persistence | Permanent (in DB) | Non-persistent (in URL) | Client-side only |
Stored XSS
Impact
Affects all users
Example
Comment form without sanitization
Persistence
Permanent (in DB)
Reflected XSS
Impact
Targeted via phishing
Example
Search query reflected in page
Persistence
Non-persistent (in URL)
DOM-based XSS
Impact
No server involvement
Example
Reading location.hash and using innerHTML
Persistence
Client-side only
Common questions
- ›“What are the different types of XSS attacks?”
- ›“How do you prevent XSS in a web application?”
- ›“Explain the difference between Stored and Reflected XSS.”
- ›“What is Content Security Policy (CSP) and how does it help?”
What interviewers look for
- Clear understanding of all three XSS types with examples
- Defense-in-depth approach (input + output + CSP)
- Knowledge of framework auto-escaping and common mistakes
- Practical prevention strategies (textContent, DOMPurify)
Short answer (60 sec)
XSS allows attackers to inject malicious scripts. Stored persists in DB, Reflected is in URL responses, DOM-based happens client-side. Prevent with input sanitization, output encoding (textContent), CSP, and framework escaping.
Detailed answer (senior level)
Stored XSS saves malicious input to the database and serves it to users. Reflected XSS reflects input from the URL in the response. DOM-based XSS manipulates the DOM on the client without server involvement. Prevention requires multiple layers: validate/sanitize input, escape output (never use innerHTML with user data), implement CSP to block inline scripts, and rely on framework auto-escaping (React, Vue, etc.).
- Using innerHTML with user input
- Only sanitizing on the client side
- Missing CSP or using 'unsafe-inline'
- Forgetting to escape in template literals or string concatenation
- Trusting framework escaping without understanding edge cases
- ✓Never trust user input — always sanitize on both client and server
- ✓Use textContent or framework escaping instead of innerHTML
- ✓Implement CSP as defense-in-depth
- ✓Stored XSS affects all users; Reflected requires phishing
- ✓DOM-based XSS happens entirely client-side
- ✓Defense-in-depth is the only reliable approach