Secure an Express application from Cross-Site Scripting (XSS) Attacks!

Take a look at **app.js** and **home.ejs**. The intern initially wrote this code, and, while they created a good first draft, there are some vulnerabilities in it. See if you can spot where exactly the XSS vulnerabilities lie and what can be done in order to secure the app.

You can type `node app.js` into the Terminal if you want to start the node server. Make sure to also refresh the mini-browser.

Restreviewer is currently storing all the reviews locally and the form to submit reviews is vulnerable to malicious code being injected into the server. 

Begin by importing the `check` method from the `express-validator` at the top of **app.js**

In the `/review` endpoint, use `express-validator` to ensure the following data to matches the format below:

| Data Input   | Format                                |
|--------------|---------------------------------------|
| `email`      | Is an email                          |
| `restaurant` | Is not empty AND blacklists the characters `<` and `>` |
| `rating`     | Is numeric                            |
| `review`     | Is not empty AND blacklists the characters `<` and `>` |

To test your changes, you can use <kbd>Ctrl</kbd> + <kbd>C</kbd> in the Terminal to stop the app and rerun it by typing `node app.js` again.


The intern currently wrote code in **home.ejs** that exposes a DOM-Based vulnerability by making use of `document.write`. 

Find an alternative way to write content to the DOM. 

Start by creating a new HTML tag with the id `“urlinfo”`.  


Now that we have a separate HTML tag with a specific `id`, we can use `getElementById` to target that object and use `textContent` to assign it to `document.baseURI`.

Add a `cookie` object to the existing session and set the appropriate properties to secure the cookie.

Implement the `helmet` middleware.

**Note**: If you implement `helmet` properly, the mini browser may appear broken. This is because of the security headers `helmet` enables. While inconvenient for this exercise, this is good for real-world security!

![An image of the mini browser with an error message saying it "refused to connect".](https://static-assets.codecademy.com/content/paths/web-security/xss/refuse_to_connect.png)

Restreview: Preventing Cross Site Scripting (XSS) Attacks

Training your team? Get up to 60% off Codecademy Teams | [Request a demo](https://www.codecademy.com/business/teams-quote)