XSS Validator

This middleware works by default for both GET and POST methods, and will throw a 400 Bad Request error when either the body or the query params contain unsafe code. Based on https://github.com/leizongmin/js-xss

Usage

This middleware is enabled globally by default. You can customize it both globally and per route like following:

export default defineNuxtConfig({

  // Global
  security: {
    xssValidator: {
      // options
    }
  }

  // Per Route
  routeRules: {
    '/my-secret-route': {
      security: {
        xssValidator: {
          // options
        }
      }
    }
  }
})

You can also disable the middleware globally or per route by setting xssValidator: false.

Options

XSS validator accepts the following configuration options:

type XssValidator = {
  methods: Array<Uppercase<string>>;
  whiteList: Record<string, any>;
  escapeHtml: boolean;
  stripIgnoreTag: boolean;
  stripIgnoreTagBody: boolean;
  css: Record<string, any> | boolean;
  throwError: boolean;
} | {};

methods

• Default: ['GET', 'POST']

List of methods for which the validator will be invoked.

whiteList

• Default: -

By specifying a whiteList, e.g. { 'tagName': 'attr-1', 'attr-2' }. Tags and attributes not in the whitelist would be filter out

stripIgnoreTag

• Default: -

Filter out tags not in the whitelist

stripIgnoreTagBody

• Default: -

Filter out tags and tag bodies not in the whitelist

escapeHtml

• Default: -

Disable html escaping (by default < is replaced by < and > by >)

css

• Default: -

If you allow the attribute style, the value will be processed by cssfilter module.

throwError

• Default: true

Whether to throw Nuxt Error with appriopriate error code and message. If set to false, it will just return the object with the error that you can handle.