Web Security · Senior · Question 69 of 75

Why can server-side rendering reintroduce XSS that the client framework would prevent?

✓Correct answer: Code that builds HTML strings, injects JSON into <script> or sets raw HTML on the server bypasses the framework's escaping
2Because SSR always disables CSP
3Because servers can't escape HTML

Explanation

Hand-written HTML in templates, metadata, or serialized state needs the same care. Use the framework's APIs instead of string concatenation.

Further reading

Test yourself

Take the Web Security · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.