Frontend code runs entirely in a browser you don't control, which makes it a common attack surface. This module covers the vulnerabilities that show up most often in client-side code — XSS, CSRF, and misconfigured CORS — plus how to handle authentication and secrets without leaving them exposed.
None of this replaces a security review, but knowing these basics prevents the most common mistakes. Work through these lessons in order, then move on to Performance.
A tour of the most frequent frontend security issues, and why the browser's trust model makes them possible.
How attackers inject scripts into a page through untrusted input, and how to prevent it.
Tricking a browser into making requests it didn't intend to, and the policy that limits cross-origin access.
Why cross-origin requests get blocked by default, and how to configure CORS correctly on both ends.
The difference between who a user is and what they're allowed to do, and common patterns like sessions and JWTs.
Where to (and where not to) keep auth tokens on the client, and why localStorage isn't always safe.
Locking down what a page is allowed to load, and why HTTPS is non-negotiable for any real site.