title: XSS Protection in Express Apps
body: <p>I am developing an express app which serves as a REST api with web client and may be future mobile clients. I am using a Oauth 2.0 token authentication for both clients. This gives a good deal of security against CSRF. I want to know <strong>How to provide security against XSS</strong>.</p>
  
  <p>*I made the tokens validity period very less, requiring the client to request with refresh_tokens and other client details for access_tokens. This makes it a bit safe but not entirely*.</p>
  
  <p>I am concerned with the with <strong>client_id and client_secret being stolen</strong> since its present in the front-end javascript code and it being used by other client to validate. <em>I am thinking of using a <strong>JWT for the client authentication</strong>, will this be helpful?</em></p>
  
  <p>Data Sanitisation is another which I am confused about. There are modules like <a href="https://github.com/chriso/validator.js" rel="nofollow">validator</a>, <a href="https://github.com/ctavan/express-validator" rel="nofollow">express-validator</a> which give regex validation. According to this <a href="http://cosmicrealms.com/blog/2014/02/07/benchmark-of-node-dot-js-json-validation-modules-part-2/" rel="nofollow">blog post</a> JSON Schema validations are fast. In the REST Api JSON will used for data exchange so I was wandering why can't I use modules like <strong><a href="https://github.com/geraintluff/tv4" rel="nofollow">tv4</a> or any other JSON Schema validators for data validations??</strong> I am not asking for suggestions to use what, I just want to know the <em>basic difference in the kind of validations each provide and specially from a point of view of XSS protection and sanitisation</em>.</p>