React Security

Priority: P0 (CRITICAL)

Preventing vulnerabilities in client-side apps.

Implementation Guidelines

• XSS: Avoid dangerouslySetInnerHTML. Sanitize via DOMPurify if needed.
• URLs: Validate javascript: protocols in user links.
• Auth: Store tokens in HttpOnly cookies. Avoid localStorage.
• Deps: Run npm audit. Pin versions.
• Secrets: Server-side only. No .env secrets in build.
• CSP: Strict Content-Security-Policy headers.

Anti-Patterns