frontend / README.md

Frontend Security — Senior Interview Prep

1 min read index source

Frontend Security — Senior Interview Prep

The security topics that come up in senior frontend interviews and code review. The senior framing: most “frontend security” is actually about not undoing the browser’s defenses (same-origin policy, cookie SameSite, CSP) and not creating injection vectors (XSS, dangerouslySetInnerHTML). Token storage and OAuth are where most apps go wrong.

Files

# Topic
01 XSS — stored, reflected, DOM-based; mitigations
02 CSRF — SameSite cookies, anti-CSRF tokens
03 Content Security Policy (CSP)
04 CORS — security implications
05 Subresource Integrity, HSTS, security headers
06 Token storage — JWT in localStorage vs httpOnly cookie
07 OAuth 2.0 / OIDC for SPAs — Auth Code + PKCE
08 Clickjacking, supply chain (npm, CDN) attacks

The senior security checklist

For any frontend code review:

  • No dangerouslySetInnerHTML/v-html with user-provided content. If you must, sanitize with DOMPurify.
  • CSP at minimum forbids inline scripts unless nonce’d; default-src 'self'.
  • All cookies for auth/session are httpOnly; secure; samesite=lax (or strict).
  • Tokens not in localStorage; httpOnly cookies for sessions.
  • CSRF protection: SameSite cookies + double-submit token for state-changing requests.
  • HTTPS only with HSTS preload.
  • SRI on external scripts (integrity attribute).
  • Avoid window.opener leak — <a target="_blank" rel="noopener noreferrer">.
  • OAuth flow: Auth Code with PKCE, not Implicit. Tokens stored in httpOnly cookies, not localStorage.
  • No secrets in client code — API keys with frontend distribution should be public-safe (publishable Stripe key, not secret).

Cross-references