Security
XSS, CSRF, Content Security Policy (CSP), CORS internals, and JWT vs HttpOnly Cookie Auth.
3 In-Depth TopicsFrontend Security: XSS, CSRF & Content Security Policy (CSP)
Core web security triad: XSS (executing unauthorized malicious scripts in user's browser), CSRF (tricking an authenticated user into sending forged requests), and CSP (HTTP headers defining trusted script/style/connect origins).
CORS Internals & Same-Origin Policy
CORS (Cross-Origin Resource Sharing) is a browser-enforced security protocol that restricts web applications from requesting resources from a different origin (Protocol + Domain + Port) unless the destination server explicitly permits it via HTTP headers.
Frontend Authentication Architecture: JWT vs HttpOnly Session Cookies
Secure frontend authentication stores sensitive session/refresh tokens in HttpOnly, Secure, SameSite=Strict cookies to protect against JavaScript-based token theft (XSS), while using short-lived in-memory access tokens for API authorization.