DOM XSS: Why Server-Side Sanitization Isn't Enough

DOM-based XSS never touches your server. Your WAF won't catch it — here's how to find and exploit it.