React

XSS in innerHTML and dangerouslySetInnerHTML If you render attacker-controlled HTML, you are one bad string away from XSS. Two APIs show up constantly in real apps: the browser DOM API: element.innerHTML the React escape hatch: dangerouslySetInnerHTML Both do the same dangerous thing: they parse a string as HTML and inject it into the page. If that string contains active content, your app can execute attacker-supplied JavaScript. This is the reference I wish more teams had pinned in their repos. ...

Single-page apps make XSS easier to hide. You load one shell, fetch data later, stitch UI together in the browser, and somewhere along the way somebody says, “It’s fine, the framework escapes it.” Sometimes that’s true. Sometimes it’s very, very false. I’ve seen teams assume that moving from server-rendered templates to React or Vue magically solves XSS. It doesn’t. SPAs change where the bug happens, not whether it can happen. ...

Chat apps are XSS magnets. That is not a criticism of Stream Chat specifically — it is just the reality of any product that renders user-generated content in real time, across devices, often with rich formatting layered on top. If you use Stream Chat, the core question is not “does Stream escape content?” The real question is “where can my app accidentally turn safe chat data into executable code?” That distinction matters. I have seen teams assume the chat SDK is the security boundary, then quietly reintroduce XSS through custom message rendering, markdown, link previews, emoji plugins, or attachment handling. ...

Cross-site scripting in React and Next.js is one of those topics that sounds simpler than it really is. A lot of developers hear “React escapes output by default” and mentally file XSS away as mostly solved. That’s true right up until you touch dangerouslySetInnerHTML, render CMS content, build a markdown feature, pass untrusted values into URLs, or mix server and client rendering in ways that make assumptions drift. The good news: React and Next.js give you a strong baseline. The bad news: they do not make you XSS-proof automatically. ...