frontend-security-coder

Use textContent instead of innerHTML for plain text, and sanitize HTML with DOMPurify before insertion when rich formatting is required. Combine this with context-aware output encoding and a strict Content Security Policy as defense in depth.

Move inline scripts to external files and use nonce-based or hash-based CSP directives in the script-src header. Start with report-only mode to catch violations, then progressively tighten the policy while monitoring reports.

sessionStorage limits token exposure to a single tab, while localStorage persists across tabs but is accessible to any script on the origin. Neither is fully XSS-proof, so pair token storage with strict CSP, sanitization, and short token lifetimes with refresh handling.

Set the CSP frame-ancestors directive or X-Frame-Options header to control which sites can embed your pages, and add JavaScript frame-busting as a fallback. Apply these protections in production while relaxing them during development when iframe embedding is needed.

Use a security auditor for high-level audits, compliance assessments, threat modeling, and penetration testing planning. Use frontend security coding guidance for hands-on implementation tasks like writing sanitization logic, configuring CSP, and fixing client-side vulnerabilities.