Architecting Fortresses: A Deep Dive into Advanced Security Measures for ReactJS Apps
summary
React's JSX escaping is not a silver bullet: JavaScript URLs in hrefs and active attributes still execute, dangerouslySetInnerHTML with raw input and embedding JSON via JSON.stringify lead to XSS, and styled-components can allow CSS injection. Concrete defenses: validate/sanitize/escape every incoming variable, sanitize HTML with DomPurify, escape CSS with css.escape, block non-http(s) protocols, lazy-load admin code to avoid leaking endpoints, run linters and dependency scans (retire.js / npm audit), and log critical security events.
AI-written summary · about
chapters (6)
- 0:00Start
- 5:01Cross Site Scripting
- 17:44Rendering HTML
- 22:40Dangerous Styles
- 33:54Insecure Client-Side Logging
- 38:28Insecure Server-Side Rendering
related talks
50mBuilding Secure React Applications
42mYou thought your React application is secure? Think again
56mBuilding Secure ReactJS Applications: Mastering Advanced Security Techniques
43mBuilding Secure ReactJS Apps: Mastering Advanced Security Techniques
25mDo not let your React be injected
32mLet me show you how React applications get hacked in the real-world
48mSecurity Risk: Single-Page Applications.
07mWhat is an XSS attack - and why should you care?