Want everyone on your software team to learn this? Get completion tracking and compliance reporting with Hacksplaining for Teams. Free 14-day trial.
URI fragments are not sent with HTTP requests, so they need to be interpreted by client-side JavaScript. You should be careful that your treatment of URI fragments does not permit the injection of malicious JavaScript. Let's see how a site might be vulnerable to DOM-based XSS attacks.
