Secure the Frontend: Authentication & Web Security Lab

09:00 – 10:15

See the whole login flow before writing any of it

authentication vs authorisation, OAuth and OIDC in browser terms, the actors

Takeaway The full login dance drawn actor by actor (browser, app, provider, API) until no arrow on the diagram is a mystery.

10:30 – 11:45

Handle tokens and cookies honestly

access and refresh tokens, storage trade-offs, where tokens must never live

Takeaway A token stolen live from localStorage by one line of injected script, and the storage design that makes the same theft fail.

12:00 – 13:00

Protect the routes

route guards, redirects that return you, deep links after login

Takeaway Protected pages that survive refresh, deep links and the back button: the three ways tutorial guards usually break.

14:00 – 15:15

Wire the API layer

interceptors, transparent refresh, handling 401 vs 403

Takeaway An API layer that attaches tokens, refreshes them mid-session and retires them on failure, with no component ever touching one.

15:30 – 17:00

Log out like you mean it

ending sessions properly, multi-tab behaviour, expired sessions mid-form

Takeaway Logout that actually ends the session, proved across two tabs, and a mid-form expiry handled without losing the user's work.

09:00 – 10:15

Understand CORS once and for all

what CORS protects, preflight requests, fixing it properly

Takeaway The CORS error read as the browser protecting someone, then fixed at the API with intent, not with a wildcard.

10:30 – 11:45

Meet XSS, the attack that owns your users

injection sinks, framework escaping and its escape hatches, CSP basics

Takeaway A working XSS attack built against the lab app, then killed twice, once by escaping and once by policy.

12:00 – 13:00

Close the cookie attacks

CSRF and when it applies, SameSite cookies, clickjacking and frames

Takeaway A CSRF attack that works against the naive setup and fails against yours: the cookie flags doing exactly what they claim.

14:00 – 15:15

Enforce roles, don't just hide buttons

permissions in the UI, display vs enforcement, roles from token claims

Takeaway The hidden admin button pressed anyway via the console, and the API refusing, because enforcement never lived in the UI.

15:30 – 17:00

Attack your own app and defend it

the attack checklist, fixing what lands, security review

Takeaway Your application attacked with the day's whole toolkit and surviving, with a written checklist you will run on every future frontend.