Web Security · Senior · Question 68 of 75
A React Server Component fetches a user record and passes the whole object to a Client Component. What's the risk?
- ✓Correct answer: All props are serialized into the HTML or RSC payload, so fields like password hashes or internal notes reach the browser
- 2Client Components can't receive objects
- 3The component will render twice
Explanation
Use a data access layer that returns DTOs with only the needed fields. React's taint APIs can mark values that must never be passed to the client.