What is an XSS attack - and why should you care?
summary
Explains that React auto-escapes props but dangerouslySetInnerHTML bypasses that and allows injected HTML and script, demonstrates a fake Twitter clone injected into comments, uses an onerror image fetch to post document.cookie to an attacker endpoint, and shows a stolen cookies DB with one captured cookie — the exploit works end to end. Recommends removing or sanitizing inputs (frontend and backend) and adding linting to detect unsafe usage.
AI-written summary · about
related talks
50mBuilding Secure React Applications
25mDo not let your React be injected
32mLet me show you how React applications get hacked in the real-world
54mArchitecting Fortresses: A Deep Dive into Advanced Security Measures for ReactJS Apps
21mLet me show you how React applications get hacked in the real-world
23mJavaScript attack surface
41mThe Last XSS Defense Talk: Why XSS Defense has radically changed in the past 7 years
40mXXSS: Exotic Cross-Site Scripting vectors