Preventing JavaScript Clickjacking: Essential Security Techniques
A user lands on your page, sees a friendly button, and clicks it. Nothing looks wrong. But the click never went
JavaScript security
Defending Against Content Security Policy (CSP) Bypass: Best Practices for JavaScript Applications
You ship a Content Security Policy, see the header show up in DevTools, and feel safe. That feeling is the trap.
Understanding JavaScript Prototype Pollution and How to Prevent It
You merge a chunk of user-supplied JSON into a plain object. Looks harmless. A moment later every object in your app
30 Days of JavaScript: Web Security and JavaScript, Day 29
One unescaped string is all it takes. A comment box, a search field, a URL parameter, someone drops a <script> tag