How do you prevent XSS attacks in a Node.js application?

Question

Accepted Answer

**XSS (Cross-Site Scripting)** — injecting malicious scripts into web pages. **Prevention techniques:** - 1. **Escape output** — HTML-encode user input. - 2. **Content Security Policy (CSP)** headers. - 3. **Input validation** — sanitize all inputs. - 4. **Use templating engines** with auto-escaping. ```javascript // Using helmet for CSP const helmet = require("helmet"); app.use(helmet()); // Manual escaping function escapeHtml(str) { return str .replace(/&/g, "&") .replace(//g, ">") .replace(/"/g, """) .replace(/'/g, "'"); } // Input validation with express-validator const { body, validationResult } = require("express-validator"); app.post("/comment", [ body("text").trim().escape(), ], (req, res) => { const errors = validationResult(req); if (!errors.isEmpty()) return res.status(400).json(errors); }); ``` **Key points:** - Never insert raw user input into HTML. - Use CSP headers to restrict script sources. - Validate and sanitize all inputs.

Node.js: How do you prevent XSS attacks in a Node.js application?