← Amazon Interview Insights

Amazon·Software Engineer·Technical Phone Screen·Senior

Senior
Jun 2026

Summary

Security engineer interview at Amazon, came down to a pretty fundamental web security question. Short and focused, felt more like a screen than a deep technical dive.

Questions Asked (1)

Q1

What are the different types of cross-site scripting (XSS) and how would you go about preventing each one?

Technical Trade-offsSystem Design
Author's notes

Covered the three main types: stored, reflected, and DOM-based.

Create a free account to read the full note

AI HintsAI Generated

Suggested Approach

Start by clearly defining the three main types of XSS (stored, reflected, DOM-based) and their root causes. Then, for each type, explain prevention techniques, emphasizing context-aware output encoding, input validation, and Content Security Policy (CSP). Finally, tie it back to secure coding practices and defense-in-depth.

Pro tip: Mention that while input validation is important, output encoding is the most critical defense because XSS occurs when untrusted data is rendered without proper escaping. Also, highlight the importance of using well-tested libraries and frameworks that auto-escape by default.

1. Define XSS and its types

Briefly explain what XSS is and categorize it into stored, reflected, and DOM-based, giving a one-sentence example of each.

2. Explain prevention for stored XSS

Focus on output encoding when rendering user data, input validation/sanitization on input, and using secure frameworks that auto-escape.

3. Explain prevention for reflected XSS

Emphasize encoding user input reflected in responses, avoiding reflection of raw input, and using CSP to mitigate impact.

4. Explain prevention for DOM-based XSS

Highlight avoiding dangerous sinks like innerHTML, using safe methods like textContent, and sanitizing data before DOM manipulation.

5. Summarize defense-in-depth

Mention additional layers: CSP, HttpOnly cookies, input validation, and security testing (e.g., static analysis, DAST).

Key Points to Mention

  • Stored XSS: malicious script persisted on server (e.g., in database) and served to other users.
  • Reflected XSS: malicious script reflected off web server, often via URL parameters or form input.
  • DOM-based XSS: vulnerability in client-side JavaScript that processes untrusted data from the DOM.
  • Output encoding: context-aware escaping (HTML, JS, CSS, URL) is the primary defense.
  • Content Security Policy (CSP): restricts sources of executable scripts, mitigating XSS impact.
  • Input validation and sanitization: while not sufficient alone, helps reduce attack surface.
  • Use of secure frameworks/libraries: React, Angular, etc., that auto-escape by default.
  • HttpOnly and Secure flags on cookies: prevent session theft via XSS.

AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.