Q58: What are React Taint APIs (taintUniqueValue / taintObjectReference) for security?
React Taint APIs prevent sensitive data (like security tokens, private keys, or user credentials) from being accidentally passed from Server Components to Client Components. By calling experimental_taintUniqueValue() or experimental_taintObjectReference(), React throws a build or runtime error if marked data is serialized to the client.
Key Takeaways
- Prevents sensitive server-only variables or objects from leaking into client JS bundles.
- Throws explicit compilation or runtime errors if tainted values cross server-client boundaries.
Knowledge Check
What happens if a server object marked with experimental_taintObjectReference is passed to a Client Component?