Render untrusted data as text, never as markup: let the framework escape it and avoid innerHTML, dangerouslySetInnerHTML and v-html. If you must accept HTML, sanitize it server side or with a maintained sanitizer before it touches the DOM. Add a Content Security Policy with nonces to remove inline script as an option, validate URLs so javascript schemes cannot end up in an href, and keep tokens out of storage any script can read.
Why interviewers ask this
Frameworks escape by default, so interviewers want to know whether you understand the holes that remain: raw HTML injection, attribute and URL sinks, and third party scripts. The answer shows whether you think in terms of sources and sinks or only remember to escape. Mentioning CSP and trusted types signals you have shipped defense in depth rather than assuming the framework handles everything for you.
How to structure your answer
- Start with the default: escape by rendering as text.
- Name the specific sinks that bypass the framework.
- Cover URL and attribute injection, not just element content.
- Add the layered defenses: CSP, sanitizer, token storage.
Example answer
The baseline is that everything untrusted gets rendered as text, which the framework does for me. So the real work is auditing the places that opt out of that. Any innerHTML, any dangerouslySetInnerHTML, any templating that writes raw markup, plus the sinks people forget: an href built from user input can carry a javascript scheme, and a style or srcdoc attribute is just as dangerous. If a feature genuinely needs rich text, for example user written descriptions, I sanitize with a maintained library and an allow list rather than trying to filter tags myself, and I do it as close to storage as I can. On top of that I want a Content Security Policy with a nonce so inline script simply does not execute, which turns most residual bugs into a blocked console message rather than a breach. And I keep session tokens in HttpOnly cookies, because if a payload does land, the blast radius should not include the user's session.
Walking into this interview soon? GhostPilot listens to your live call, spots the question the moment it is asked, and puts a structured answer on your screen in real time. Try it on your next mock, or grab a $29 Session Pass, no subscription, for the real thing.
See how it worksFollow-up questions to expect
- Where does a Content Security Policy fail to help you?
- How would you safely render user submitted rich text?
- What is DOM based XSS, and why do server side filters miss it?
Related frontend developer questions
Your interviewer will ask their own version of this. Paste your actual job description into the free Question Predictor and get the 20 questions that role is most likely to ask, with what each one is really probing.
Predict my questions