Hardening KrakenJS Applications with Helmet and Content Security Policy
Learn how to mitigate XSS risks in KrakenJS by implementing a strict Content Security Policy (CSP) using Helmet middleware and dynamic nonces.
Loading…
ReadMeFeed / Community knowledge
#web-security
Real questions. Useful conversations. Find the people who know your stack.
krakenjsDesigning a Minimal Secure Facebook Login Integration for a Web Application
Learn how to implement a minimal, secure Facebook Login flow using OAuth 2.0, keeping the app secret server‑side, exchanging codes for long‑lived tokens, and storing them in an HttpOnly cookie.
facebookImplementing OAuth 2.0 PKCE for Public Clients
Learn how to add PKCE to OAuth 2.0 authorization code flow for SPAs and mobile apps, preventing authorization code interception with a per‑request verifier and challenge.
CodePen Embedded Pens: Architecture, Isolation Guarantees, and Operational Verification
An architecture note on CodePen's Embedded Pens: the minimal stateless design, sandbox and CSP trust boundaries, operational verification steps, failure modes, and design change triggers that would require re-evaluating isolation guarantees.
codepenSecuring Public Clients: Why PKCE is the New Standard for OAuth 2.0
Public clients can't keep secrets. Learn how PKCE (Proof Key for Code Exchange) secures OAuth 2.0 flows for SPAs and mobile apps by replacing static secrets with dynamic, one-time verifiers.
Flask's Session Is a Cookie, Not a Vault: Designing Logins Around That Fact
Flask's session is a signed cookie, not a server-side store. Here's what that means for login code, secret rotation, revocation, and when to move to Redis-backed sessions.
pythonFirefox's Enhanced Tracking Protection: Blocking Trackers Without Breaking Sites
Firefox's Enhanced Tracking Protection blocks known trackers by default, but aggressive blocking can break websites. The real challenge is maintaining privacy without sacrificing functionality.
firefoxChoosing the Right SameSite Value for Cross-Site Cookies in Chrome
A decision guide for picking SameSite=Lax, Strict, or None for cross-site cookies in Chrome, with a comparison table, explicit Set-Cookie examples, and DevTools validation steps.
chromeDjango CSRF Protection: An Architecture Note on Requirements, Boundaries, and Failure Modes
An architecture note on Django's CSRF middleware: what it must guarantee, the minimal session-backed token design, the trust boundaries, operational checks, and failure modes.
django