| name | react-security |
| description | Prevent XSS, secure auth flows, and harden React client-side applications. Use when preventing XSS, securing auth flows, or auditing third-party dependencies in React. |
| metadata | {"triggers":{"files":["**/*.tsx","**/*.jsx"],"keywords":["dangerouslySetInnerHTML","token","auth","xss","react security","csp","content security policy","sanitize html","secure cookie","jwt react","oauth react","dompurify"]}} |
React Security
Priority: P0 (CRITICAL)
Prevent XSS Attacks
- Never use
dangerouslySetInnerHTML without sanitization. Use DOMPurify.sanitize(input) for all user-provided HTML.
- Avoid
javascript: protocols in href or src.
See implementation examples for DOMPurify sanitization and secure cookie configuration.
Secure Authentication
- Store JWT/Sessions in
HttpOnly and Secure cookies to prevent theft via XSS. Never store secrets in localStorage or in built JS bundle.
- Data Flow: Escape all serialized state if injecting into HTML (e.g., in SSR). Use Content Security Policy (CSP) to restrict script sources and prevent inline execution.
Harden Application Boundaries
- CSRF Protection: Use CSRF tokens for state-changing requests (PUT/POST/DELETE). Implement SameSite=Strict cookies where applicable.
- Input Sanitization: Always validate and sanitize user inputs on backend. Frontend validation for UX only.
- Dependency Management: Run
npm audit / pnpm audit regularly. Pin specific dependency versions and use npm-check-updates.
- Security Headers: Ensure server sends
X-Frame-Options: DENY, X-Content-Type-Options: nosniff, and Permissions-Policy.
Anti-Patterns
- No
eval(): RCE risk.
- No Serialized State: Don't inject JSON into DOM without escaping.
- No Client Logic for Permissions: Backend must validate.
References
See references/REFERENCE.md for DOMPurify usage, CSP headers, OAuth2/JWT auth patterns, and CSRF protection.
Canonical response anchors
When this skill applies, preserve the following domain terminology or equivalent concrete examples in the answer when relevant:
- Pin specific dependency versions
