According to https://www.quora.com/What-are-the-key-difference-between-ReactNative-and-NativeScript/answer/Valentin-Stoychev , "ReactNative as using the notation found in React for inlining the UI declaration in a single file." Is this supposed to mean that when writing React (or ReactNative) code you have to use inline JavaScript?

Would React therefore get blocked by default by a Content Security Policy (CSP)?

According to http://www.asd.gov.au/publications/protect/protecting_web_apps.htm :

A Content Security Policy (CSP) provides security controls which can mitigate attacks such as cross-site scripting (XSS) and other attacks based on introducing malicious or otherwise undesirable content into a web application. A CSP achieves this by specifying a whitelist of content sources for a web application that a compatible browser then enforces. A large variety of content can be controlled using a CSP including scripts, images and audio or video.

By default, a CSP also implements other mitigations beyond whitelisting content sources. The main additional mitigations are:

  • Inline JavaScript will not execute: this mitigates the most common types of XSS attacks.
  • JavaScript code will not be created from strings: this prevents attackers abusing JavaScript functionality to execute arbitrary JavaScript code.

P.S. I'm totally new to React.

1 Answer 1


No, that's a totally different thing :-) He simply meant that when you write react, you put the UI directly into the component (although you can of yourse also put it in a separate "template" file and then reuse it).

Something like this:

 class Thing extends React.Component {
     render() {
        return <div>{this.props.text}</div>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.