CSRF, XSS and Input Security
Cross-Site Request Forgery abuses a user's authenticated browser context to perform unwanted actions. Cross-Site Scripting attempts to execute attacker-controlled JavaScript in a user's browser.
React escapes normal text output, which provides an important baseline against XSS, but unsafe HTML rendering, third-party scripts, insecure DOM APIs, and poorly sanitized content can reintroduce risks.
Authentication architecture should consider CSRF protection, especially when authentication relies on cookies and cross-origin requests are involved.
Security Is Not One Feature
Authentication libraries do not eliminate application-level authorization, input validation, CSRF considerations, secret management, or secure coding practices.
Key Takeaways
- Treat all external input as untrusted.
- Avoid unsafe HTML injection unless content is properly sanitized.
- Consider CSRF explicitly when using cookie-based authentication.