Frontend Security — Senior Interview Prep

The security topics that come up in senior frontend interviews and code review. The senior framing: most “frontend security” is actually about not undoing the browser’s defenses (same-origin policy, cookie SameSite, CSP) and not creating injection vectors (XSS, dangerouslySetInnerHTML). Token storage and OAuth are where most apps go wrong.

Files

The senior security checklist

For any frontend code review:

• No dangerouslySetInnerHTML/v-html with user-provided content. If you must, sanitize with DOMPurify.
• CSP at minimum forbids inline scripts unless nonce’d; default-src 'self'.
• All cookies for auth/session are httpOnly; secure; samesite=lax (or strict).
• Tokens not in localStorage; httpOnly cookies for sessions.
• CSRF protection: SameSite cookies + double-submit token for state-changing requests.
• HTTPS only with HSTS preload.
• SRI on external scripts (integrity attribute).
• Avoid window.opener leak — <a target="_blank" rel="noopener noreferrer">.
• OAuth flow: Auth Code with PKCE, not Implicit. Tokens stored in httpOnly cookies, not localStorage.
• No secrets in client code — API keys with frontend distribution should be public-safe (publishable Stripe key, not secret).

Cross-references

• Backend security (OWASP, password hashing, JWT pitfalls): Security
• CORS protocol details: CORS at the Protocol Level — Preflight, Credentials, Exposed Headers
• Cookie + storage details: Storage APIs — localStorage, sessionStorage, IndexedDB, Cookies, Cache API, OPFS