XSS Mistakes in Single-Page Apps and How to Fix Them
Single-page apps make XSS easier to hide. You load one shell, fetch data later, stitch UI together in the browser, and somewhere along the way somebody says, “It’s fine, the framework escapes it.” Sometimes that’s true. Sometimes it’s very, very false. I’ve seen teams assume that moving from server-rendered templates to React or Vue magically solves XSS. It doesn’t. SPAs change where the bug happens, not whether it can happen. ...