XSS: types and prevention
Comes up in: Web fundamentals, Recruiter screen, React
This concept is being written. It gets the full five steps — explanation, predict, interview angle, practice with tests, and review cards. Here is exactly what it will cover, so you can study it elsewhere in the meantime.
What it covers
- stored, reflected, DOM-based XSS
- contextual output encoding
- React escapes text by default
- danger spots (
dangerouslySetInnerHTML,href="javascript:",innerHTML,eval, URL params) - sanitising with DOMPurify
- Trusted Types
Words you will know
What you will practise
- find and fix 5 XSS bugs
Interview questions this answers
- Explain XSS. How does React protect you and where can you still be vulnerable?