DOM-based cross-site scripting (DOM XSS) is a type of XSS where the vulnerability is in the page's own client-side JavaScript. The script reads data from a source the attacker can control, such as the URL, and writes it into the page in an unsafe way.

Every HTML document has a Document Object Model (DOM): the browser's object representation of the page. In DOM XSS, the malicious data never has to appear in the server's response. The page's script modifies the DOM using attacker-controlled data, and the browser runs it.

See it in action

The video below demonstrates DOM XSS using the Damn Vulnerable Web Application (DVWA), a deliberately vulnerable application for practice.

How to defend against DOM-based XSS

• Avoid writing data from untrusted sources into the HTML document. Where you must, use safe methods such as textContent or setAttribute instead of innerHTML or document.write.
• Do not pass untrusted data to eval, setTimeout with a string, or similar functions.
• If untrusted data must be inserted, encode it for the exact context (HTML, JavaScript or URL). This is easy to get wrong, so prefer the safe methods above.
• Validate input against an allow-list where possible, for example letters, digits and spaces only.
• Add a strict Content Security Policy as a second layer of defence.

How Vooki Pro helps

• Includes checks for DOM-based XSS.
• Flags unsafe JavaScript sinks such as innerHTML, eval and string-based setTimeout.
• Enabling AI detection in the scan wizard also enables DOM-XSS detection.
• Also checks client-side prototype pollution and unsafe postMessage handling.

Frequently asked questions

How is DOM XSS different from reflected XSS?

In DOM XSS the vulnerable code runs in the browser: the page's own JavaScript writes untrusted data into the page, often without the server ever seeing the payload.

How do I prevent DOM XSS?

Use safe sinks such as textContent, avoid innerHTML and eval with untrusted data, and add a strict Content Security Policy.

Related: Cross-Site Scripting (XSS): reflected, stored and DOM-based · A practical guide to Content Security Policy (CSP)