What they're testing
Whether you know where the framework's protection ends — because that's where the holes are.
The short answer~30 seconds
React escapes every value interpolated into JSX, so {userInput} can never execute script. Four places it doesn't protect: dangerouslySetInnerHTML, an href accepting a javascript: URL, user data flowing into a string style attribute, and any third-party library that writes to the DOM itself. The second deserves attention because it looks harmless: <a href={user.website}> where website is javascript:alert(1) executes on click.
The long answer
With dangerouslySetInnerHTML the correct handling isn't avoidance — sometimes you genuinely must render HTML, say from a CMS — but sanitising with an allow-list library such as DOMPurify or sanitize-html, on the SERVER. Sanitising in the client means an attacker calling your API directly bypasses the whole defence.
The second layer worth having is a Content-Security-Policy. It doesn't fix the hole but bounds the damage: inline scripts are blocked and scripts only load from origins you allow, so a payload that slips through has little to work with. Configuring it properly needs nonces for legitimate scripts — a one-time cost that pays for itself.
Last, and where many teams choose wrongly: where to keep the auth token. localStorage is readable by JavaScript, so a single XSS exfiltrates it. An HttpOnly cookie can't be read by JavaScript, so an XSS can still make requests as the user but can't carry the token away. Pair it with SameSite=Lax against CSRF. It's a trade between two risks, and a good answer names both rather than just naming a storage location.
What they'll ask next
?Is CSRF still a problem for token-based APIs?
If the token lives in an Authorization header and no cookie is sent automatically, CSRF doesn't apply, because browsers don't attach headers on their own. If you use cookies, it does — and SameSite is the first line of defence rather than a CSRF token.
These lose points
- Saying "React is safe so XSS isn't a concern". It's safe on the default path, and holes live on the exceptional one.