Guarding against Cross Site Scripting (XSS)

Cross Site Scripting attacks are one of the prevalent and serious attacks today. XSS exploits can endanger users and reputations in profound ways, but vulnerabilities occur easily, especially when we don't practice an awareness of this particular area.

In this recipe, we're going to discover an XSS vulnerability and solve it.

Getting ready

Let's create a folder called app, initialize it as a package, install express, and create an index.js file:

$ mkdir app
$ cd app
$ npm init -y
$ npm install --save express
$ touch index.js

Our index.js file should look like this:

const express = require('express')
const app = express()

app.get('/', (req, res) => {
  const {prev = '', handoverToken = '', lang = 'en'} = req.query
  pretendDbQuery((err, status) => {
    if (err) {
      res.sendStatus(500)
      return
    }
    res.send(`
      <h1>Current Status</h1>
      <div id=stat>  
        ${status}
      </div>
      <br&gt...