Auth & Client-Side Security
high Severity
Free Check
DOM-Based XSS Sink Analysis
Scans frontend JavaScript for dangerous execution sinks (eval, document.write, innerHTML, location.href) fed by unvalidated inputs.
Why It Matters
DOM XSS occurs directly inside the visitor’s browser and executes attacker payloads without touching the origin web server.
How We Check This
We analyze client scripts for dangerous patterns where URL hash, search parameters, or postMessage feed directly into HTML injection sinks.
How to Fix & Implement
Copy-paste configuration blocks tailored for your web server or edge proxy.
nginx snippet
Use textContent instead of innerHTML; use DOMPurify when rendering rich HTML
Frequently Asked Questions
How does DOM XSS differ from Reflected XSS?
Reflected XSS involves the server echoing input into HTML, while DOM XSS happens entirely in the client-side JavaScript execution.