Frontend Security
The browser threat model, and the mistakes that actually ship.
16 topics
The Browser Security Model
Origins, the same-origin policy, and the boundaries everything else in frontend security is built on.
core25 minXSS & Output Encoding
The three kinds of cross-site scripting, why context decides the escaping, and what a framework does and does not protect.
core25 minContent Security Policy
A header that tells the browser what your page is allowed to load and execute, and how to deploy one without breaking the site.
core25 minInjection Beyond XSS
Open redirects, prototype pollution, template and CSV injection, and the other places untrusted input becomes behaviour.
deep20 minCSRF & SameSite Cookies
Why the browser attaches your cookies to someone else's request, and the two defences that actually work.
core25 minCORS Misconfigurations
The permissive settings that turn a relaxation of the same-origin policy into a data breach.
core20 minClickjacking & Framing
Getting a user to click something they cannot see, and the header that stops your site being framed.
core15 minSecurity Headers
The response headers worth setting, what each actually prevents, and the ones that are now obsolete.
core20 minAuth Token Storage
Where a session lives in the browser, why localStorage is the wrong answer, and how refresh works without leaking.
core25 minOAuth & OIDC in the Browser
Authorization code with PKCE, why the implicit flow is dead, and what a frontend is actually responsible for.
deep25 minServer Action & RSC Authorisation
The new authorisation surface introduced by server components and actions, and why the layout you thought was guarding it is not.
core25 minClient-Side Data Exposure
The data that ends up in the browser without anyone deciding to put it there — payloads, bundles, source maps and caches.
core20 minThird-Party Scripts & Tag Managers
Every external script runs with your origin's full privileges, and a tag manager hands that power to whoever can log in.
core20 minDependency & Supply Chain Security
The npm attack surface — typosquats, compromised maintainers, malicious install scripts — and the controls that actually help.
core20 minPrivacy, Consent & GDPR
The legal constraints that shape European frontends — consent before tracking, data minimisation, and the rights users can exercise.
core25 minSecurity Fundamentals
The handful of ideas — trust boundaries, least privilege, defence in depth — that every specific vulnerability is an instance of.
core25 minshared