The attacks a frontend is actually responsible for, and the browser primitives that mitigate them.
11 articles
Listed inCORSWeb Securityon
A CORS error is a server configuration problem wearing a browser error message. What the preflight actually asks, what breaks when credentials are involved, and the fixes that are not a proxy.
Listed inCORSWeb Securityon
MDN on simple versus preflighted requests, the full header set, and the rules credentials change.
Listed inOWASP Security RisksWeb Securityon
The industry checklist of web application security risks, with mitigations and cheat sheets per entry.
Listed inContent Security PolicyWeb Securityon
MDN on directives, nonces and hashes, and rolling a policy out in report-only mode first.
Listed inWeb Security BasicsWeb Securityon
The same-origin policy, XSS, CSRF, and clickjacking — the threat model everything else refines.
Listed inCache ControlWeb Securityon
Cache headers, ETags, immutable assets, and the invalidation strategy a hashed filename gives you.
Listed inAuthentication StrategiesWeb Securityon
Sessions, JWTs, OAuth, and SSO — where the token lives and what that decision costs you.
Listed inOWASP Security RisksWeb Securityon
The industry checklist, filtered down to the entries a frontend can actually do something about.
Listed inContent Security PolicyWeb Securityon
Directives, nonces, and rolling out a policy in report-only mode without breaking the app.
Listed inCORSWeb Securityon
Preflights, credentials, and why a CORS error is almost always a server configuration problem.
Listed inHTTPSWeb Securityon
TLS, certificates, HSTS, and mixed content — plus the browser features that require a secure context.