Advanced Web, API & Modern Stack
React & Next.js Attacks
XSS via dangerouslySetInnerHTML, SSRF in API routes, and SSR pitfalls.
React escapes output by default, which prevents most XSS — but modern React/Next apps still have plenty of attack surface, especially on the server side that Next.js introduces.
Client-side (React)
- dangerouslySetInnerHTML — the #1 React XSS sink; renders raw HTML unescaped.
- Injecting into href/src — javascript: URLs and unsanitised links.
- Leaked secrets — anything in NEXT_PUBLIC_* or the bundle is public; hunt API keys.
Server-side (Next.js)
- API routes / route handlers — full server endpoints: SSRF, injection, IDOR, auth flaws live here.
- Middleware auth bypass — flawed matchers or header trust (several real Next.js CVEs bypassed middleware auth).
- SSR data exposure — getServerSideProps leaking secrets into the page props/HTML.
- Server Actions — treat them as untrusted endpoints; validate inputs and authorization.
// DANGER — XSS if `bio` is attacker-controlled
<div dangerouslySetInnerHTML={{ __html: user.bio }} />
// Safer: render as text, or sanitise with DOMPurify first.