WayrApp Backend & Ecosystem Documentation - v1.0.0
    Preparing search index...

    Module xssProtection

    XSS Protection Middleware for Cross-Site Scripting Attack Prevention

    This middleware provides protection against Cross-Site Scripting (XSS) attacks by sanitizing user input using the industry-standard xss library. It recursively processes request bodies, query parameters, and URL parameters to remove or neutralize potentially malicious HTML and JavaScript content while preserving legitimate data.

    The middleware implements a layered security approach, working in conjunction with the basic input sanitization middleware to provide comprehensive protection. While the basic sanitizer removes control characters and null bytes, this XSS protection specifically targets HTML/JS injection attempts and provides detailed security logging for monitoring purposes.

    This middleware is applied in the main application security stack (src/app.ts) after basic input sanitization and before request processing. It serves as a critical security layer for protecting against one of the most common web application vulnerabilities, ensuring that user-generated content cannot execute malicious scripts in other users' browsers.

    The middleware maintains data structure integrity while sanitizing content, supporting nested objects and arrays to handle complex request payloads. All XSS attempts are logged with contextual information for security monitoring and incident response.

    Exequiel Trujillo

    1.0.0

    Express request object containing user input to sanitize

    Param: _res

    Express response object (unused)

    Express next function to continue middleware chain

    // Usage in main application security stack
    import { xssProtection } from '@/shared/middleware/xssProtection';

    app.use(express.json());
    app.use(express.urlencoded({ extended: true }));
    app.use(sanitizeInput);  // Basic sanitization first
    app.use(xssProtection);  // XSS protection second

    // Layered security approach in main app
    import { sanitizeInput, xssProtection } from '@/shared/middleware';

    // Apply security middleware in sequence
    app.use(sanitizeInput);    // Remove control characters
    app.use(xssProtection);    // Prevent XSS attacks
    app.use(requestLogger);    // Log sanitized requests

    // XSS sanitization example:
    // Input:  { "comment": "<script>alert('XSS')</script>Hello World" }
    // Output: { "comment": "&lt;script&gt;alert('XSS')&lt;/script&gt;Hello World" }

    // Nested object sanitization:
    // Input:  { "user": { "bio": "<img src=x onerror=alert(1)>", "posts": ["<script>...</script>"] } }
    // Output: { "user": { "bio": "&lt;img src=x onerror=alert(1)&gt;", "posts": ["&lt;script&gt;...&lt;/script&gt;"] } }

    // Security logging for XSS attempts:
    // When XSS content is detected, logs include:
    // - Original content (truncated for security)
    // - Request path where attempt occurred
    // - Client IP address for tracking
    // - Timestamp for incident response

    Settings

    Member Visibility