System Design · Junior · Question 43 of 75

How do you protect against XSS when displaying user content?

Explanation

Frameworks escape text by default; the dangerous parts are innerHTML, dangerouslySetInnerHTML and javascript: links. If HTML is needed (an editor), it's sanitized on the server and the client. CSP restricts script sources - a second line of defense.

Further reading

Problem with a question

System Design · Junior · question 43

Test yourself

Take the System Design · Junior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.

Take this quiz