Vue.js Developer interview question · Most asked
What security risks should Vue developers watch for?
Summary
Vue escapes text interpolation ({{ }}) and attribute bindings, so the main XSS risks are what bypasses that: v-html with untrusted content, user-controlled URLs in href/src (javascript: URLs), user-provided templates compiled at runtime, and server-side templates that interpolate user data into the HTML that Vue then mounts on.
Longer Answer
Rules from the Vue security guide: never use non-trusted content as a component template; sanitise HTML with DOMPurify before v-html (or render Markdown to sanitised HTML on the server); validate URLs (allow only http:/https:); do not bind user-controlled style objects without care; and use a Content Security Policy. Client-side checks (route guards, hidden buttons) never replace server-side authorisation.
Key Points
- v-html with untrusted content is XSS.
- Validate URLs; no user templates.
- Sanitise with DOMPurify; use CSP.
- Authorise on the server.
Deep dive: Code Clinic: review a Vue comment list
More most-asked Vue.js Developer questions
- Options API or Composition API: what is the difference, and which would you use?
- How do props work, and what is one-way data flow?
- How does Vue 3's reactivity system work, and how does it differ from Vue 2's?
- computed, watch or watchEffect: when do you use each?
- ref or reactive: what is the difference, and when do you use each?
- How do you use Vue Router: dynamic routes, nested routes and navigation guards?
- Why does v-for need a key, and why should it not be the index?
- What are composables, and why did they replace mixins?