Node Cookbook - Third Edition

Preventing protocol-handler-based XSS

Our server is still vulnerable to XSS injection.

In this scenario, an attacker is going to steal the status (which represents privileged information).

Let's use the following command to create a malicious data collection server:

$ node -e "require('http').createServer((req, res) => {   console.log(     req.connection.remoteAddress,      Buffer(req.url.split('/attack/')[1], 'base64').toString().trim()   ) }).listen(3001)"

We're using the -e flag (evaluate) to quickly spin up an HTTP server that logs the user IP address, and stolen status. It's expecting the status to be base64 encoded (this helps to avoid potential errors on the client side).

Now let's start the fixed-app server from the main recipe:

$ cd fixed-app ...