Do I need to clear the data that came from the websocket?

Question

XSS

The data is taken from the database and cleaned up (script tags are removed, etc.). Then they are sent via wesocket to the client and displayed as html. Do I need to clean the data with js on the client before displaying? Can someone somehow replace this data on the way to the client by adding some kind of script? Then clearing the data on the client would remove the script.

Answer 1

Paranoids recommend cleaning all external data, even if it is your service and is located on the internal network.
This increases the cost, but gives additional guarantees.
However, businesses assess risks, and often create trusted zones for convenience.