jojo.
All workCase 02 / 03

Hardening auth on the frontend

Tokens, user content and cookies are frontend attack surface. I treated them as my job and shut three common attack paths.

Context
Digital Agency
Role
Mid-level Frontend Developer
When
2021 — 2023
Stack
JWT · DOMPurify · CORS
XSSCSRFtoken replay

Three attack paths, each closed with a specific control.

01 · The problem

Nobody asked for this one. Auth and user-generated content are where a frontend bug becomes a security bug. I could see the risk, so I started the work myself.

02 · Constraints

Existing sessions had to keep working, so nobody got logged out. Third-party embeds still had to load.

03 · What I did

  1. Refresh-token rotation

    Short-lived access tokens; each refresh token works once, so a stolen one gets caught on replay.

  2. Sanitise before render

    DOMPurify on every path that renders user-supplied HTML, so injected scripts never reach the DOM.

  3. Cookies and CORS locked down

    SameSite and Secure flags plus a strict CORS policy against cross-site requests.

04 · Result

  • 3
    attack paths closed: XSS, CSRF, token replay

05 · What I’d do differently

Next time I'd add a handshake and put a fingerprint in a cookie for every user, logged in or not.

Next caseShipped.A Swiss storefront, solo, in one month