How does one sanitize output through NodeJS SocketIO?
I basically have a very simple SocketIO chat application that renders messages broadcasted by the server, and I'm trying to figure out how I could prevent messages such as
<script>...</script>
or other forms of XSS to be injected in the frontend chat.
What I'm doing is basically:
$('#chat').append(message);
I've been told to escape the message on the backend (output) and not on the frontend. Is that correct? If so, how should I escape it? Any node modules?