Fix XSS in API Responses in Nuxt

Nuxt's SSR and hydration cycle can be a playground for XSS if you're lazy with API data. Trusting the backend to sanitize is a rookie move. If you're using v-html to render user-supplied content from an endpoint without a sanitization layer, you're handing over the DOM to the attacker. In a Nuxt context, this isn't just a client-side risk; it can lead to server-side injection if the payload executes during rendering.

The Vulnerable Pattern

The Secure Implementation

Vue and Nuxt escape content by default when using double curly braces {{ }}. The vulnerability is introduced when developers use the 'v-html' directive to render rich text. To fix this, we use 'isomorphic-dompurify' which works in both Node.js (during SSR) and the browser. The sanitization process strips dangerous tags (like