Do not let your React be injected
summary
Explains that client-side XSS is real: third‑party CDN widgets can inject scripts that phish or deface pages, and React app vectors include dangerouslySetInnerHTML, eval and component props that accept HTML. Recommends enforcing CSP plus Trusted Types to sanitize inserted HTML, using nonces for SSR (Next.js automates this) and switching to build‑time CSS like zero-runtime CSS (Linaria) so styles land in files instead of requiring unsafe inline styles.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 1:03What is XSS
- 3:33XSS attack examples
- 8:36XSS in React and fixes
- 10:43CSP protection
- 14:21CSP vs CSS-in-JS
- 18:45CSR and SSR solutions
- 23:01Summary and recommendations
related talks
50mBuilding Secure React Applications
07mWhat is an XSS attack - and why should you care?
54mArchitecting Fortresses: A Deep Dive into Advanced Security Measures for ReactJS Apps
42mYou thought your React application is secure? Think again
48mSecurity Risk: Single-Page Applications.
32mLet me show you how React applications get hacked in the real-world
21mLet me show you how React applications get hacked in the real-world
56mBuilding Secure ReactJS Applications: Mastering Advanced Security Techniques