Understanding and Preventing XSS Attacks in JavaScript Applications
One malicious string in the wrong text box, and an attacker is running code inside your users’ browsers, on your domain,
JavaScript
Master the versatile world of web programming with our JavaScript tutorials, covering concepts from basic syntax to advanced features and frameworks.
HTML5 Web Storage Security Risks: Safeguarding localStorage and sessionStorage
You ship a login flow, stash the session token in localStorage because it survives refreshes, and move on. It works. Then
Preventing JavaScript Clickjacking: Essential Security Techniques
A user lands on your page, sees a friendly button, and clicks it. Nothing looks wrong. But the click never went
Managing JavaScript Libraries: Best Practices for Reducing Security Risks
You add one small library to save an afternoon. It pulls in twelve more you never read. Six months later a
Defending Against Content Security Policy (CSP) Bypass: Best Practices for JavaScript Applications
You ship a Content Security Policy, see the header show up in DevTools, and feel safe. That feeling is the trap.
Understanding JavaScript Prototype Pollution and How to Prevent It
You merge a chunk of user-supplied JSON into a plain object. Looks harmless. A moment later every object in your app
Clickjacking Explained: How to Protect Your Website from Hidden HTML Frames
You click a button that says “Play.” Nothing seems to happen. But the click didn’t land on the button you saw.
30 Days of JavaScript: Building a Portfolio Website, Day 30
You’ve spent 29 days writing JavaScript. This is where the series ends, and it’s the one day that pays the other
30 Days of JavaScript: Web Security and JavaScript, Day 29
One unescaped string is all it takes. A comment box, a search field, a URL parameter, someone drops a <script> tag
30 Days of JavaScript: Web Workers and Multithreading, Day 28
You have hit this bug even if you never named it. Click a button, the page locks up for half a
30 Days of JavaScript: Server-Side Rendering with JavaScript, Day 27
Day 27 of the 30-day JavaScript journey. So far most of what we’ve built renders in the browser: the server ships
30 Days of JavaScript: WebSockets and Real-Time Communication, Day 26
Load a chat app, type a message, and it shows up on someone else’s screen a fraction of a second later.
30 Days of JavaScript: Introduction to TypeScript, Day 25
You have spent 24 days writing JavaScript that runs first and complains later. A typo in a property name, a number
30 Days of JavaScript: Progressive Web Apps (PWAs), Day 24
You build a site, it works great, then someone opens it on a train that dives into a tunnel and the
30 Days of JavaScript: GraphQL and JavaScript, Day 23
You need a user’s name and email. The REST endpoint hands you back the whole user object: forty fields, three of
30 Days of JavaScript: JavaScript Design Patterns, Day 22
You’ve solved the same problem more than once. A global that everything reaches into and nobody owns. A settings object that
30 Days of JavaScript: Introduction to Node.js, Day 21
For 20 days you’ve written JavaScript that runs in a browser. Day 21 is where that changes. In our 30 Days
30 Days of JavaScript: Accessibility and JavaScript, Day 20
Tab through enough of the web and the cracks show fast. A menu that won’t open from the keyboard. A button
30 Days of JavaScript: JavaScript Animation Basics, Day 19
A page that snaps between states feels broken even when it works fine. Toggle a menu open instantly and people flinch.
30 Days of JavaScript: Introduction to Functional Programming, Day 18
Day 18. You’ve written a fair bit of JavaScript by now, and some of it has probably bitten you: a function