Secure the Frontend — Authentication & Web Security Lab

09:00 – 10:15

See the whole login flow before writing any of it

—authentication vs authorisation, OAuth and OIDC in browser terms, the actors

—Takeaway The full login dance drawn actor by actor — browser, app, provider, API — until no arrow on the diagram is a mystery.

10:30 – 11:45

Handle tokens and cookies honestly

—access and refresh tokens, storage trade-offs, where tokens must never live

—Takeaway A token stolen live from localStorage by one line of injected script — and the storage design that makes the same theft fail.

12:00 – 13:00

Protect the routes

—route guards, redirects that return you, deep links after login

—Takeaway Protected pages that survive refresh, deep links and the back button — the three ways tutorial guards usually break.

14:00 – 15:15

Wire the API layer

—interceptors, transparent refresh, handling 401 vs 403

—Takeaway An API layer that attaches tokens, refreshes them mid-session and retires them on failure — with no component ever touching one.

15:30 – 17:00

Log out like you mean it

—ending sessions properly, multi-tab behaviour, expired sessions mid-form

—Takeaway Logout that actually ends the session — proved across two tabs, and a mid-form expiry handled without losing the user's work.

09:00 – 10:15

Understand CORS once and for all

—what CORS protects, preflight requests, fixing it properly

—Takeaway The CORS error read as the browser protecting someone — then fixed at the API with intent, not with a wildcard.

10:30 – 11:45

Meet XSS, the attack that owns your users

—injection sinks, framework escaping and its escape hatches, CSP basics

—Takeaway A working XSS attack built against the lab app — then killed twice, once by escaping and once by policy.

12:00 – 13:00

Close the cookie attacks

—CSRF and when it applies, SameSite cookies, clickjacking and frames

—Takeaway A CSRF attack that works against the naive setup and fails against yours — the cookie flags doing exactly what they claim.

14:00 – 15:15

Enforce roles, don't just hide buttons

—permissions in the UI, display vs enforcement, roles from token claims

—Takeaway The hidden admin button pressed anyway via the console — and the API refusing, because enforcement never lived in the UI.

15:30 – 17:00

Attack your own app and defend it

—the attack checklist, fixing what lands, security review

—Takeaway Your application attacked with the day's whole toolkit and surviving — with a written checklist you will run on every future frontend.