Security Interview Questions

Use dangerouslySetInnerHTML to render HTML strings from a CMS or API, and always sanitize external content with DOMPurify to prevent XSS.

React auto-escapes output to prevent XSS, but dangerouslySetInnerHTML, eval, and third-party content require explicit sanitization. Use HttpOnly cookies for JWTs, validate input on both sides, add CSP headers, and audit dependencies regularly.