Frontend Handbook

Security

Short handbooks on how a web app knows who is calling and keeps attackers out: the main concepts, the mistakes behind real incidents, and live demos run against a real server.

2 of 2 pages written

Written
JSON Web Tokens
What a JWT proves and who can read it, the verifier mistakes behind real attacks, expiry, refresh and revocation, where to keep tokens in the browser, and key rotation, each with a live demo.
Written
XSS, CSP and CSRF
How untrusted content becomes running script and how encoding stops it, what a Content-Security-Policy does as a second wall, and how another site makes a request as the logged-in user, each with a live demo.