# React Security & Best Practices (React / Next.js) > XSS prevention, CSRF protection, dangerouslySetInnerHTML, Content Security Policy, HTTPS, sanitization - 22 interview questions - Senior - [Interview Questions: React / Next.js](https://sharpskill.dev/en/technologies/react-next/interview-questions.md) ## 1. What is an XSS (Cross-Site Scripting) attack? **Answer** An XSS attack involves injecting malicious JavaScript code into a web application to execute it in other users' browsers. The attacker exploits validation or escaping flaws to steal cookies, session tokens, or perform unauthorized actions. React provides native protection by automatically escaping JSX values, but vulnerabilities remain with dangerouslySetInnerHTML or direct DOM manipulation. ## 2. How does React protect against XSS attacks by default? **Answer** React automatically escapes all values inserted via JSX by converting them to plain text before rendering. This protection prevents malicious script execution even if HTML code is injected into the data. Unlike innerHTML which interprets and executes HTML, React treats tags as plain text, making it impossible to inject malicious JavaScript through standard props or state. ## 3. Why is dangerouslySetInnerHTML considered dangerous in React? **Answer** This property bypasses React's native XSS protection by inserting raw HTML directly into the DOM without escaping. If the content comes from an untrusted source or external API, it may contain malicious JavaScript that will be executed. The explicit name dangerouslySetInnerHTML forces developers to consciously acknowledge the security risk and implement proper sanitization with libraries like DOMPurify. ## 19 more questions available - What is the main difference between a Stored XSS and Reflected XSS attack? - What approach should be preferred to display HTML from an external API in React? Sign up for free: https://sharpskill.dev/en/login ## Other React / Next.js interview topics - [JavaScript Essentials](https://sharpskill.dev/en/technologies/react-next/interview-questions/javascript-essentials.md): 25 questions, Junior - [React Fundamentals](https://sharpskill.dev/en/technologies/react-next/interview-questions/react-fundamentals.md): 20 questions, Junior - [React Hooks](https://sharpskill.dev/en/technologies/react-next/interview-questions/react-hooks.md): 22 questions, Junior - [Component Lifecycle](https://sharpskill.dev/en/technologies/react-next/interview-questions/component-lifecycle.md): 18 questions, Junior - [React Router](https://sharpskill.dev/en/technologies/react-next/interview-questions/react-router.md): 20 questions, Junior - [State Management with Context](https://sharpskill.dev/en/technologies/react-next/interview-questions/state-management-context.md): 18 questions, Junior - [Forms & Controlled Components](https://sharpskill.dev/en/technologies/react-next/interview-questions/forms-controlled-components.md): 20 questions, Mid-Level - [Data Fetching & API](https://sharpskill.dev/en/technologies/react-next/interview-questions/fetching-data-api.md): 20 questions, Mid-Level - [React Query (TanStack Query)](https://sharpskill.dev/en/technologies/react-next/interview-questions/react-query-tanstack.md): 20 questions, Mid-Level - [Styling & CSS-in-JS](https://sharpskill.dev/en/technologies/react-next/interview-questions/styling-css-in-js.md): 18 questions, Mid-Level - [Next.js Fundamentals](https://sharpskill.dev/en/technologies/react-next/interview-questions/nextjs-fundamentals.md): 25 questions, Mid-Level - [TypeScript with React](https://sharpskill.dev/en/technologies/react-next/interview-questions/typescript-react.md): 20 questions, Mid-Level - [Next.js Data Fetching](https://sharpskill.dev/en/technologies/react-next/interview-questions/nextjs-data-fetching.md): 24 questions, Mid-Level - [Next.js Server Actions](https://sharpskill.dev/en/technologies/react-next/interview-questions/nextjs-server-actions.md): 20 questions, Mid-Level - [Next.js Routing & Navigation](https://sharpskill.dev/en/technologies/react-next/interview-questions/nextjs-routing-navigation.md): 22 questions, Mid-Level - [Next.js API Routes](https://sharpskill.dev/en/technologies/react-next/interview-questions/nextjs-api-routes.md): 20 questions, Mid-Level - [Next.js Metadata & SEO](https://sharpskill.dev/en/technologies/react-next/interview-questions/nextjs-metadata-seo.md): 18 questions, Mid-Level - [Next.js Middleware & Auth](https://sharpskill.dev/en/technologies/react-next/interview-questions/nextjs-middleware-auth.md): 22 questions, Mid-Level - [React Testing](https://sharpskill.dev/en/technologies/react-next/interview-questions/react-testing.md): 20 questions, Mid-Level - [Zustand State Management](https://sharpskill.dev/en/technologies/react-next/interview-questions/zustand-state-management.md): 18 questions, Mid-Level - [React Performance Optimization](https://sharpskill.dev/en/technologies/react-next/interview-questions/react-performance-optimization.md): 22 questions, Senior - [Error Boundaries & Error Handling](https://sharpskill.dev/en/technologies/react-next/interview-questions/react-error-boundaries.md): 18 questions, Senior - [Advanced React Patterns](https://sharpskill.dev/en/technologies/react-next/interview-questions/advanced-react-patterns.md): 20 questions, Senior - [Next.js Advanced Features](https://sharpskill.dev/en/technologies/react-next/interview-questions/nextjs-advanced-features.md): 24 questions, Senior - [Next.js Deployment & Production](https://sharpskill.dev/en/technologies/react-next/interview-questions/nextjs-deployment-production.md): 20 questions, Senior - [Architecture & Design Patterns](https://sharpskill.dev/en/technologies/react-next/interview-questions/react-architecture-patterns.md): 22 questions, Senior - [React Server Components](https://sharpskill.dev/en/technologies/react-next/interview-questions/react-server-components.md): 26 questions, Senior - [Next.js Internationalization](https://sharpskill.dev/en/technologies/react-next/interview-questions/nextjs-internationalization.md): 20 questions, Senior --- Source: SharpSkill (https://sharpskill.dev), tech interview preparation for your real stack. HTML version of this page: https://sharpskill.dev/en/technologies/react-next/interview-questions/react-security-best-practices