Building Secure ReactJS Applications: Mastering Advanced Security Techniques
summary
Covers concrete fixes: stop putting access control in the client, never embed secrets, and treat URLs as the biggest real-world risk (Google sees ~1/3 of attacks from untrusted URLs); cites incidents like British Airways (≈380,000 cards), Fortnite (≈200M users) and eBay URL exploits. Recommends explicit URL validation (allow only https), sanitize HTML with DOMPurify before using dangerouslySetInnerHTML, use CSS.escape for injected styles, run eslint/npm audit/retire.js, and prefer server checks, lazy loading and strict redirect allow‑lists.
AI-written summary · about
chapters (18)
- 0:00React security challenges
- 3:17Security domains in React
- 7:30Anti-patterns in React code
- 10:25XSS attacks and risks
- 19:16Defending against XSS
- 23:34Validation sanitization encoding
- 25:00Securing dangerous URLs
- 29:21Safe HTML rendering
- 33:16JSON performance patterns
- 35:47Preventing CSS injection
- 38:58Safe DOM with refs
- 41:28Access control in React
- 43:58Auditing React libraries
- 46:52Preventing open redirects
- 49:39Insecure server-side rendering pitfalls
- 52:07Secure client-side logging
- 53:11CSP best practices
- 55:22Automated security checks
related talks
43mBuilding Secure ReactJS Apps: Mastering Advanced Security Techniques
54mArchitecting Fortresses: A Deep Dive into Advanced Security Measures for ReactJS Apps
50mBuilding Secure React Applications
42mYou thought your React application is secure? Think again
19mCritical Security Mistakes in Frontend Applications
48mSecurity Risk: Single-Page Applications.
15mLocking Down PII: Why a Strong Frontend is Your First Defense
58mPractical Secure Development and Operations with JavaScript in 2020