Building Secure React Applications
summary
React is not a safe-by-default framework and five common pitfalls enable XSS: unvalidated JavaScript URLs in href/action, use of dangerouslySetInnerHTML without sanitization, unescaped prop/type values, CSS-based exfiltration, and old React <0.14 behaviors that disable escaping. Practical fixes shown: client-side URL validation, CSS-escaping libraries, run HTML through DOMPurify before injecting, serialize embedded JSON (Yahoo serializer) instead of JSON.stringify, add CSP strict-dynamic, and run retire.js / npm audit to catch vulnerable third‑party packages.
AI-written summary · about
chapters (11)
- 0:00Start
- 4:14Session Hijacking
- 7:48A Polyglot Attack
- 9:23Securing React Components
- 11:32Protecting React from Standard Content Injection
- 19:51Validate Url
- 23:13Wysiwyg Editor
- 27:59Safe Handling of Json
- 29:38Yahoo Serializer
- 30:32Third-Party Components
- 33:43Npm Audit
related talks
42mYou thought your React application is secure? Think again
54mArchitecting Fortresses: A Deep Dive into Advanced Security Measures for ReactJS Apps
25mDo not let your React be injected
32mLet me show you how React applications get hacked in the real-world
07mWhat is an XSS attack - and why should you care?
56mBuilding Secure ReactJS Applications: Mastering Advanced Security Techniques
21mLet me show you how React applications get hacked in the real-world
48mSecurity Risk: Single-Page Applications.