IK
Interview Knowledge Book
Topics
Practice
Examples
Playground
RU
node
Safe encoding and security headers
Encode untrusted HTML text and shape a minimal set of defensive response headers.
index.js
function escapeHtml(value) { return value.replace(/[&<>]/g, (char) => ({ '&': '&', '<': '<', '>': '>' })[char]); } const headers = { 'content-security-policy': "default-src 'self'", 'set-cookie': 'sid=abc; HttpOnly; Secure; SameSite=Strict', }; console.log(escapeHtml('<img src=x onerror=alert(1)>')); console.log(headers['content-security-policy'].replace(/'/g, '')); console.log('sameSite', /SameSite=([^;]+)/.exec(headers['set-cookie'])[1].toLowerCase());
Run
Stop
Reset