Defend the browser. This two-day course covers the full frontend attack surface: XSS (reflected, stored, DOM-based, mutation), CSP configuration, secure cookies, CSRF, SRI, client-side storage, postMessage, and framework-specific security for React, Angular and Vue. Hands-on labs against vulnerable frontends.
Covers every frontend attack vector and the defenses for each. Framework-specific modules for React, Angular and Vue. (Times are approximate.)
Go beyond basic XSS. Exploit reflected XSS through URL parameters, headers, and error messages. Exploit stored XSS through form inputs, file names, and metadata fields. Cover filter evasion techniques, polyglot payloads, and how WAFs can be bypassed. Then implement the layered defense: encoding, CSP, and input validation.
DOM-based XSS never touches the server. Exploit innerHTML, document.write, eval, and jQuery sinks. Cover mutation XSS (mXSS) where the browser's HTML parser transforms safe-looking input into executable code. Implement defenses: use textContent instead of innerHTML, avoid dangerous APIs, and deploy Trusted Types.
Content Security Policy is the strongest defense against XSS when configured correctly. Build a strict CSP from scratch: default-src, script-src with nonces, style-src, img-src, connect-src, frame-ancestors. Deploy CSP reporting (report-uri, report-to) and analyze real violations. Cover the common mistakes that make CSP ineffective.
Cookies carry sessions, preferences, and tracking data. Set HttpOnly, Secure, SameSite (Strict or Lax), Domain, Path, and Max-Age/Expires correctly. Understand cookie prefixes (__Host- and __Secure-). Cover cookie theft via XSS, cookie fixation, and cookie tossing attacks.
Implement CSRF protection using synchronizer tokens, double-submit cookies, and SameSite cookies. Understand why CORS preflight is not a CSRF defense. Cover CSRF in JSON APIs, multipart uploads, and login CSRF. Test each defense against a real CSRF attack.
When you load JavaScript or CSS from a CDN, you trust that CDN completely. SRI (Subresource Integrity) hashes verify that the file has not been tampered with. Implement SRI attributes, handle hash updates on library upgrades, and understand the fallback behavior.
localStorage, sessionStorage, IndexedDB and cookies each have different security properties. Understand what data is safe to store client-side (never tokens in localStorage), how XSS makes all client-side storage vulnerable, and how to minimize the blast radius. Implement secure patterns for each storage type.
Cross-origin communication via postMessage is powerful and frequently exploited. Validate the origin of incoming messages. Restrict the target origin of outgoing messages. Cover the common mistakes: wildcard origins, missing origin checks, and trusting message data without validation.
React escapes JSX by default, but dangerouslySetInnerHTML, href with javascript: URLs, and server-side rendering introduce XSS risks. Cover React-specific security patterns, how to use DOMPurify safely, and how to configure CSP with React's rendering model.
Angular's DomSanitizer protects against XSS by default, but bypassSecurityTrustHtml and template injection can re-introduce it. Cover Angular-specific security: AOT compilation benefits, template injection via user-controlled templates, and safe binding patterns.
Vue escapes template expressions by default, but v-html and render functions introduce XSS. Cover Vue-specific security patterns, SSR security, and how to configure CSP with Vue's template compilation.
Given a frontend application (React, Angular, or Vue, your choice) with planted XSS, CSRF, storage, and CSP vulnerabilities, find each one, document it, and implement the fix. Score against a frontend security checklist.
Review the frontend security checklist covering CSP, cookies, storage, framework-specific controls, and third-party script management. Cover ongoing monitoring and how to stay current with browser security features.
Two days of hands-on frontend security covering XSS, CSP, CSRF, client-side storage and framework-specific patterns for React, Angular and Vue.
Corporate and sovereign cohorts, and bespoke on-site delivery, on request.