Appendix

References

• OWASP Top Ten

  • The OWASP Top Ten web application security risk list.

• Content Security Policy (CSP) Fetch Directives

  • A complete list of CSP fetch directives.

• Regex Cheat Sheet

  • A useful cheat sheet when writing regular expressions by hand.

• CSP Browser Support

  • An up-to-date list of supported CSP features by each browser.

Libraries

• DomPurify

  • An XSS sanitizer.

• Knex.js

  • An SQL query builder for JavaScript.

• Sequelize

  • A TypeScript and Node.js ORM.

• jsonwebtoken

  • An implementation of JSON Web Tokens for Node.js.

Playgrounds

• jjencode demo

  • See how all JavaScript can be encoded using only a few symbols.

• The CORS Playground

  • See how various HTTP headers affect requests made with CORS.

• Cross-Origin Isolation Playground

  • See how various HTTP security headers affect cross-origin requests.

• Strict CSP Hashing

  • See how base64-encoded SHA-256 hashes can be generated for CSP.

• Regulex

  • A regular expression visualizer.

• SRI Hash Generator

  • See how an SRI hash can be generated from a given URL.

• jwt.io

  • A JWT debugger.

Tooling

• The npm audit GitHub Action

  • A GitHub action that runs npm audit.

• The yarn audit GitHub Action

  • A GitHub action that runs yarn audit.

• Redux DevTools

  • Debug a Redux application's state changes.

• ESLint XSS Plugin

  • An ESLint plugin for XSS detection.

• javascript-obfuscator

  • A JavaScript obfuscator.

• UglifyJS

  • A JavaScript minifier and compressor.

• ESLint No-Console Plugin

  • An ESLint plugin to prevent the use of console in production.

• Dependabot

  • A tool for monitoring vulnerabilities in dependencies and keeping dependencies up-to-date.

• CSP HTML Webpack Plugin

  • Automatically generate a CSP meta tag using webpack.

• Secretlint

  • A linting tool to prevent committing credentials.

Services

• Rollbar and Sentry

  • Tools for discovering, monitoring, and debugging production errors.

• AWS Secrets Manager

  • Manage secrets using a centralized, access-controlled service.

Misc

• Sharing sessionStorage between tabs for secure multi-tab authentication

  • An article about sharing sessionStorage data across tabs.

• Space Jam Website (1996)

  • A fun example of a site from the early days of Web 1.0 that is still up.