Hardening auth on the frontend
Tokens, user content and cookies are frontend attack surface. I treated them as my job and shut three common attack paths.
Three attack paths, each closed with a specific control.
01 · The problem
Auth and user-generated content are where frontend bugs become security bugs. Nobody asked for this work: I saw the risk and started it myself.
02 · Constraints
Existing sessions had to keep working, so nobody got logged out. Third-party embeds still had to load.
03 · What I did
Refresh-token rotation
Short-lived access tokens; each refresh token works once, so a stolen one gets caught on replay.
Sanitise before render
DOMPurify on every path that renders user-supplied HTML, so injected scripts never reach the DOM.
Cookies and CORS locked down
SameSite and Secure flags plus a strict CORS policy against cross-site requests.
04 · Result
- 3attack paths closed: XSS, CSRF, token replay
05 · What I’d do differently
Next time I'd add a handshake and put a fingerprint in a cookie for every user, logged in or not.