You thought your React application is secure? Think again
summary
React is mostly secure by default but concrete failures happen: injecting a javascript:alert payload into an href attribute bypasses React’s output encoding; control characters and case tricks defeat naive string checks; a real vulnerable version of react-json-pretty renders unescaped HTML via dangerouslySetInnerHTML, turning a published package into an XSS vector. Fixes are specific: validate/normalize URL schemes, URL-encode hrefs, avoid dangerouslySetInnerHTML, run SAST and DAST tools (Snyk or npm audit plus OWASP ZAP) and track dependency fixes.
AI-written summary · about
chapters (7)
- 0:00Start
- 2:51Introduction to Cross-Site Scripting
- 5:09Live Coding
- 8:19Javascript Alert
- 34:06Static Application Security Scanners
- 35:15Dynamic Application Security Testing
- 39:14React Security Linter
related talks
50mBuilding Secure React Applications
21mLet me show you how React applications get hacked in the real-world
32mLet me show you how React applications get hacked in the real-world
21mLet Me Show You How React Applications Get Hacked in the Real-World
54mArchitecting Fortresses: A Deep Dive into Advanced Security Measures for ReactJS Apps
56mBuilding Secure ReactJS Applications: Mastering Advanced Security Techniques
25mDo not let your React be injected
48mSecurity Risk: Single-Page Applications.