What vulnerabilities do you know and how do you deal with them?

Main vulnerabilities in the frontend and ways to combat them:

• XSS (Cross-Site Scripting) — injection of malicious scripts.

  • Use escaping and sanitizing of user input.
  • Apply Content Security Policy (CSP).
  • Use safe methods for inserting data into the DOM (e.g., textContent instead of innerHTML).

• CSRF (Cross-Site Request Forgery) — forging requests on behalf of the user.

  • Use CSRF tokens in forms and requests.
  • Check the Origin and Referer headers.

• Clickjacking — deceiving the user through iframes.

  • Set the X-Frame-Options header.

• Authentication and authorization vulnerabilities

  • Store tokens securely (e.g., HttpOnly cookie).
  • Use modern authentication methods (OAuth, JWT with validation).

• Resource loading vulnerabilities

  • Check and restrict content sources.

Example of XSS protection in React:

function SafeComponent({ userInput }) {
  return <div>{userInput}</div>; // React automatically escapes
}

To insert HTML, use sanitizing libraries like DOMPurify.