01. Introduction to Frontend Security & Threat Modeling
Explore the theoretical foundations of frontend security, browser threat modeling, Same-Origin Policy (SOP) mechanics, DOM architecture, and the attack landscape across SPAs, SSR, and Micro-Frontends.
02. Modern Framework Security & DOM-Based Vulnerabilities
Master security mechanisms, dangerous escape hatches, and mitigation techniques in React, Vue, Angular, Svelte, Client-Side Prototype Pollution, and the Trusted Types API.
03. Content Security Policy (CSP v3) & Subresource Integrity (SRI)
Learn how to deploy strict nonce-based Content Security Policy (CSP v3) with strict-dynamic, subresource integrity (SRI), CSP violation telemetry, and header configurations across Nginx, Node.js, Python, Go, and Java.
04. Client-Side Authentication, Token Storage & Browser Storage Hazards
Master client-side token security, OAuth 2.0 PKCE, Backend-For-Frontend (BFF) architecture, Web Workers for in-memory token storage, and secure HttpOnly cookie prefixes.
05. Frontend Security Scanners & CI/CD Automated Defense
Implement frontend security automation using SAST linters (eslint-plugin-security, Semgrep), dependency scanners (retire.js, npm audit), DAST analyzers (DOMInvader, Lighthouse), and GitHub Actions CI/CD workflows.
06. Hands-On Lab: Exploiting & Securing a Modern React SPA
Step-by-step hands-on vulnerability lab demonstrating DOM XSS token theft from LocalStorage, automated data exfiltration, and multi-layered remediation using DOMPurify, Strict CSP, and HttpOnly cookies.
07. References, Standards & Technical Resources
Authoritative specifications, RFCs, OWASP cheat sheets, CVE case studies, and security tooling resources for frontend application security.
Frontend Security Playbook
Master modern frontend application security, browser threat modeling, DOM-based vulnerability mitigations, Content Security Policy (CSP v3), OAuth 2.0 PKCE, and Secure Client Architecture.