How cross-site scripting reaches UI sinks, what React/HTML escaping does and doesn’t save, and layered defenses.

intermediate

Threat-model SPAs: assets, attackers, XSS/CSRF/supply-chain, and where frontend controls actually land.

intermediate

Actionable XSS checklist: sinks, sanitization, CSP, cookies, URLs, markdown, and PR review prompts.

intermediate

Cross-site request forgery against cookie sessions: SameSite, CSRF tokens, and SPA fetch patterns.

intermediate

Reduce XSS blast radius with CSP — script-src nonces/hashes, strict-dynamic, report-only rollout, and what CSP does not fix.

advanced

HttpOnly, Secure, SameSite, Path, Domain, and Priority: set session cookies so XSS and CSRF have less room.

intermediate

Why localStorage JWTs are XSS bait, cookie alternatives, refresh patterns, and SPA session designs that age better.

intermediate

Unsafe redirect targets in login return URLs and how to allowlist paths without breaking product flows.

intermediate

Stop UI redress attacks with frame-ancestors CSP and X-Frame-Options; know when embedding is intentional.

intermediate

SRI hashes on script/link tags so CDN tampering fails closed; generate integrity and pair with CSP.

intermediate

npm malware, lockfiles, pin policies, and practical frontend controls against dependency attacks.

intermediate

API keys in React env vars are public: what’s safe in the browser, map keys, and how leaks happen.

beginner

TLS everywhere, HSTS, and mixed active/passive content blocks that break modern browsers.

beginner

Validate href/src/navigation targets: block javascript: and data: traps, open redirects, and XSS via URLs.

intermediate

Secure window.postMessage: targetOrigin, event.origin checks, schema validation, and iframe bridges.

advanced

iframe sandbox flags explained: lock down embeds, re-enable only needed capabilities, combine with CSP.

advanced

Session UX that doesn’t weaken security: login states, logout everywhere, idle timeouts, and step-up auth.

intermediate

Design FE for 429s: Retry-After, backoff, idempotency, and login lockouts without trapping users.

intermediate

What browser fingerprinting collects, FE APIs that leak entropy, and privacy-preserving product defaults.

advanced