Securing NestJS JWT Authorization Tokens from XSS Attacks

The XSS Threat Vector

Cross-Site Scripting (XSS) attacks targeting JWT tokens stored in localStorage are among the most common API security vulnerabilities.

HttpOnly Cookies

Never store JWTs in localStorage. Use HttpOnly, Secure, SameSite=Strict cookies:

res.cookie('access_token', token, {
  httpOnly: true,
  secure: process.env.NODE_ENV === 'production',
  sameSite: 'strict',
  maxAge: 7  24  60  60  1000
});

Content Security Policy Headers

Add strict CSP headers to block inline script execution using helmet middleware in NestJS.

CSRF Protection

Implement double-submit cookie pattern or synchronizer token pattern for all state-changing requests.

Input Validation

Always sanitize user input using class-validator and DTOs in NestJS. Never interpolate user data directly into HTML.