XSS Types and Mitigation
Explain reflected, stored, and DOM XSS. How do you mitigate each in a web app?
Answers use simple, clear English.
Quick interview answer
Reflected: payload in request echoed immediately. Stored: payload persisted then shown to others. DOM: client-side script unsafely writes attacker data into the DOM.
Detailed answer
Reflected: payload in request echoed immediately. Stored: payload persisted then shown to others. DOM: client-side script unsafely writes attacker data into the DOM. Mitigate with context-aware output encoding, CSP, HttpOnly cookies, sanitizing HTML with vetted libraries, and avoiding dangerous sinks (innerHTML, eval). React's default escaping helps but dangerouslySetInnerHTML and href=javascript: remain risks.
Full explanation
React's default escaping helps but dangerouslySetInnerHTML and href=javascript: remain risks.
Real example & use case
Comment box storing <script> that executes for every moderator viewing the queue.
Pros & cons
Pros of CSP+encoding: defense in depth. Cons: rich-text HTML is hard — need sanitizer allowlists.