Prevention of Cross-Site Scripting (XSS) Attacks

app-xss.tsx

import express from 'express';
import helmet from 'helmet';

const app = express();

// Use helmet to set various HTTP headers
app.use(helmet());

// Set a custom Content Security Policy
app.use(helmet.contentSecurityPolicy({
  directives: {
    defaultSrc: ["'self'"],
    scriptSrc: ["'self'", "'unsafe-inline'"],
    styleSrc: ["'self'", "'unsafe-inline'"],
    imgSrc: ["'self'", "data:", "https:"],
  },
}));

app.get('/hello', (req, res) => {
  const name = req.query.name;
  // Ensure proper encoding when rendering user input
  res.send(`<h1>Hello ${encodeURIComponent(name as string)}!</h1>`);
});