Cross-Site Scripting (XSS) Interview Questions and Answers

Learn Cross-Site Scripting (XSS) with interview questions, Mermaid diagrams, Spring Boot examples, prevention techniques, and enterprise security best practices.

Cross-Site Scripting (XSS) - Interview Questions & Answers

Cross-Site Scripting (XSS) is one of the most common web application vulnerabilities listed in the OWASP Top 10. It occurs when an attacker injects malicious JavaScript into a trusted web page, causing the victim's browser to execute the attacker's code.

XSS can lead to:

Session Hijacking
Cookie Theft
Account Takeover
Website Defacement
Phishing
Malware Distribution

Every Java, Spring Boot, Full Stack, Security, and Solution Architect interview typically includes questions about XSS.

Q1. What is Cross-Site Scripting (XSS)?

Answer

Cross-Site Scripting (XSS) is a client-side injection attack where malicious JavaScript is injected into a web page and executed in another user's browser.

Instead of attacking the server, XSS targets the browser.

XSS Overview

flowchart LR

Attacker --> MaliciousScript

MaliciousScript --> WebApplication

WebApplication --> VictimBrowser

VictimBrowser --> ExecuteJavaScript

Impact

Cookie Theft
Session Hijacking
Credential Theft
Unauthorized Actions

Q2. What are the different types of XSS?

Answer

There are three major types of XSS.

Type	Description
Stored XSS	Script stored in database
Reflected XSS	Script reflected from request
DOM-based XSS	Executed through browser DOM

XSS Types

mindmap
  root((XSS))
    Stored XSS
    Reflected XSS
    DOM Based XSS

Q3. What is Stored XSS?

Answer

Stored XSS occurs when malicious JavaScript is permanently stored in the application.

Examples:

Blog comments
Product reviews
Forum posts
Chat messages

Every user viewing the page executes the malicious script.

Stored XSS

flowchart TD

Attacker --> Comment

Comment --> Database

Database --> Victim

Victim --> ExecuteScript

Example

A malicious script is saved in a product review and runs whenever customers view that page.

Q4. What is Reflected XSS?

Answer

Reflected XSS occurs when user input is immediately returned in the HTTP response without proper encoding.

The payload is not stored.

Reflected XSS

flowchart LR

Attacker --> MaliciousURL

MaliciousURL --> Application

Application --> VictimBrowser

VictimBrowser --> ExecuteScript

Common Targets

Search Pages
Login Pages
Error Pages
Contact Forms

Q5. What is DOM-Based XSS?

Answer

DOM-Based XSS happens entirely inside the browser.

The server may never see the malicious payload.

The vulnerability occurs because JavaScript modifies the DOM using untrusted input.

DOM-Based XSS

flowchart TD

URL --> JavaScript

JavaScript --> DOM

DOM --> ExecuteScript

Common Causes

innerHTML
document.write()
eval()
Untrusted DOM manipulation

Q6. What are the consequences of XSS?

Answer

Successful XSS attacks can result in:

Cookie theft
Session hijacking
Credential theft
Account takeover
Phishing
Defacing web pages
Malware delivery

Attack Impact

flowchart TD

XSS --> CookieTheft["Cookie Theft"]

XSS --> SessionHijacking["Session Hijacking"]

XSS --> CredentialTheft["Credential Theft"]

XSS --> AccountTakeover["Account Takeover"]

Q7. How can XSS be prevented?

Answer

The most effective prevention techniques include:

Output Encoding
Input Validation
HTML Escaping
Content Security Policy (CSP)
HttpOnly Cookies
Secure Frameworks
Avoid inline JavaScript

Prevention Pipeline

flowchart LR

UserInput["User Input"] --> Validation

Validation --> Encoding

Encoding --> Browser

Spring Boot Recommendations

Use Thymeleaf auto-escaping
Use Spring Security headers
Enable Content Security Policy
Validate user input

Q8. How does Spring Security help prevent XSS?

Answer

Spring Security provides several built-in protections.

Features include:

Security Headers
Content Security Policy (CSP)
X-XSS-Protection (legacy browsers)
HttpOnly Cookies
Secure Cookies

Spring Security Protection

flowchart TD

Client --> SpringSecurity["Spring Security"]

SpringSecurity["Spring Security"] --> SecurityHeaders["Security Headers"]

SecurityHeaders["Security Headers"] --> SpringBootApplication["Spring Boot Application"]

Additional Protection

Thymeleaf auto-escaping
React automatic escaping
Angular sanitization

Q9. What are common XSS implementation mistakes?

Answer

Common mistakes include:

Rendering unescaped HTML
Using innerHTML
Using eval()
Trusting user input
Missing Content Security Policy
Disabling output encoding
Exposing session cookies to JavaScript

Wrong Design

User Input

↓

HTML Page

↓

Execute Script ❌

Correct Design

User Input

↓

Validation

↓

HTML Encoding

↓

Safe Output ✅

Q10. What are the enterprise best practices for preventing XSS?

Answer

Follow these best practices:

Validate all user input.
Encode all output.
Escape HTML properly.
Enable Content Security Policy (CSP).
Use HttpOnly and Secure cookies.
Avoid inline JavaScript.
Keep frontend libraries updated.
Use modern frameworks with automatic escaping.
Perform regular penetration testing.
Follow OWASP XSS Prevention Cheat Sheet.

Enterprise XSS Protection

flowchart TD

Users --> WAF

WAF --> LoadBalancer["Load Balancer"]

LoadBalancer["Load Balancer"] --> SpringSecurity["Spring Security"]

SpringSecurity["Spring Security"] --> SpringBootApplication["Spring Boot Application"]

SpringBootApplication["Spring Boot Application"] --> Browser

Defense in Depth

flowchart LR

InputValidation["Input Validation"] --> OutputEncodingCspHttponly["Output Encoding → CSP → HttpOnly Cookies → Browser"]

XSS Prevention Checklist

mindmap
  root((Prevent XSS))
    Output Encoding
    Input Validation
    HTML Escaping
    CSP
    HttpOnly Cookies
    Secure Cookies
    Spring Security
    Security Testing

Senior Interview Tip

XSS is primarily a browser-side attack, so preventing it requires multiple layers of defense.

A production-ready Spring Boot application should combine:

Input Validation
Output Encoding
Content Security Policy (CSP)
Spring Security Headers
HttpOnly Cookies
Secure Cookies
Modern UI frameworks (React, Angular, Vue)
WAF
Regular Security Testing
OWASP Secure Coding Practices

Remember:

Never trust user input.
Always encode output before rendering it in HTML.
Avoid inserting untrusted data directly into the DOM.

Quick Revision

XSS is a browser-side injection attack.
The three types are Stored, Reflected, and DOM-Based XSS.
XSS can steal cookies and hijack user sessions.
Always validate input and encode output.
Enable Content Security Policy (CSP).
Use HttpOnly and Secure cookies.
Avoid innerHTML, eval(), and document.write().
Spring Security helps by adding security headers.
Perform regular security testing.
Combine secure coding, CSP, WAF, and monitoring for enterprise-grade XSS protection.