LWCIntermediaterich-textxsssecurity
Use lightning-formatted-rich-text safely for user content
Real World Scenario
Community posts rich HTML displayed in LWC—XSS concern from malicious script tags.
Expected Answer
• lightning-formatted-rich-text sanitizes platform-side
• Never use lwc:dom-manual innerHTML for user content
• Apex stripTags additional server sanitization if exporting
• CSP blocks inline scripts in Experience sites
• Moderation queue for user generated content
• Test XSS payloads in security review
• Plain text preview option for sensitive contexts
Follow-Up Questions & Answers
Click to expand — each follow-up includes a direct, interview-ready answer
Main difference: use case and scale. lightning-formatted-rich-text sanitizes platform-side. Never use lwc:dom-manual innerHTML for user content. Pick based on your integration pattern and team capability. User HTML is hostile—platform rich text component or sanitize server-side always. Balance speed of delivery with maintainability.
Architect Perspective
User HTML is hostile—platform rich text component or sanitize server-side always.