Frontend: Preventing XSS in a React App

Users can submit markdown with links and code that is rendered in your React app. Explain the XSS surface and how to close it.

Technical Reference & Key Concepts

The Challenge: XSS in User-Generated Content

Your app renders user-submitted markdown. A security review flags a stored XSS risk. You must explain the attack surface and defend it.

Core questions to address:

  1. Where can untrusted content escape its intended treatment in a React app?
  2. How do you safely render markdown, and what attack vectors remain after choosing a renderer?
  3. What defense-in-depth layers would you add?