new·Earn with mozg — 20% of every monthSend somebody here and take a fifth of every plan payment they make, for as long as they keep paying — not a bounty on the first invoice. Your handle is the link, the window is thirty days, and the commission lands on your balance the second they pay. Free to join: if you have signed in, you already have the link. mozg.sh/earnall news →
mozg.beta
Sign in

OWASP Cheat Sheets · all subjects

xss prevention & output encoding

5 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Output escaping for XSS prevention in Node.js

To prevent XSS attacks, escape all HTML and JavaScript content shown to users. Use `escape-html` module for context-aware escaping. When rendering user-supplied HTML (rather than escaping it), use a maintained sanitizer such as `DOMPurify` with `jsdom` for server-side use, or the `sanitize-html` module. Avoid `node-esapi` as it is no longer actively maintained.

Primary defense against XSS attacks

Output escaping is the primary defense against XSS attacks. All HTML and JavaScript content shown to users must be escaped using context-aware tools like `escape-html`, or sanitized using maintained packages like `DOMPurify` or `sanitize-html` when rendering user-supplied HTML.

X-XSS-Protection header deprecation and recommendation

The X-XSS-Protection header is deprecated in modern browsers. To disable the XSS Auditor and prevent additional security issues on the client side, set the header to `X-XSS-Protection: 0`. Use `app.use(helmet.xssFilter());` which sets this value. For modern browsers, implement a strong Content-Security-Policy instead.

Content-Security-Policy directives with helmet

Configure Content-Security-Policy to prevent XSS and Clickjacking attacks by allowing content only from approved sources. Key directives: `defaultSrc` (default for all directives), `scriptSrc` (prevents XSS), `frameAncestors` (prevents Clickjacking), `imgSrc`, `styleSrc`. Example: `app.use(helmet.contentSecurityPolicy({ directives: { defaultSrc: ["'self'"], scriptSrc: ["'self'"], frameAncestors: ["'none'"], imgSrc: ["'self'", "'http://imgexample.com'"], styleSrc: ["'none'"] } }));`

Primary defense against XSS attacks in JWT context

Output encoding and ensuring that JWT libraries do not accept unsecured JWTs with alg=none. The token structure itself provides protection through cryptographic signatures (digital signature or MAC) to ensure the token has not been tampered with.

Give your agent this brain