Ever found a cross-site scripting bug that never once touched the server? Dom-based xss explained simply comes down to one idea: the vulnerability lives entirely in the browser’s own JavaScript, which means it can slip past server-side defenses completely. This post shows exactly where that gap opens up, and how to spot it.