Articles

X-Frame-Options

• The Most Common XSS Vulnerability in React.js Applications
• Cybersecurity threatscape - Positive Technologies' quarter report on cyber threats and recommendations on how to stay safe.
• Trusted Types help prevent Cross-Site Scripting - About new browser API that might help obliterate DOM XSS.

Code

Linters

• `eslint-plugin-no-unsanitized` - ESLint rules to disallows unsafe innerHTML, outerHTML, insertAdjacentHTML and alike.
• `eslint-config-sec` - ESLint rules for writing safe and secure client code.

Sanitizers

• `dompurify` - XSS sanitizer for HTML, MathML and SVG
• `sanitize-html` - Clean up user-submitted HTML.

Serializers

• `serialize-javascript` - Serialize JavaScript safely - HTML characters and JS line terminators are escaped automatically.

• JavaScript Secure Coding Practices - A guide written for anyone who is using the JavaScript for web development.
• AJAX Security Cheatsheet - A starting point for AJAX security.
• Security Policy - How to add a security policy to your Github repository.

Dependencies

Serializers

• Vulnerable Dependency Management - About tools for detecting vulnerable third-party dependencies.
• `audit-ci` - NPM and Yarn dependencies audit for CI/CD.
• `dtrack-audit` - OWASP Dependency Track API client for CI/CD.
• Github Automated Security Fixes - How to use automated or manual pull requests to easily update vulnerable dependencies.

Headers

Content-Security-Policy

• CSP Is Dead, Long Live CSP! - On the Insecurity of Whitelists and the Future of Content Security Policy.
• Strict CSP - To get real value out of CSP, your policy must prevent the execution of untrusted scripts.
• Webpack CSP configuration - Webpack is capable of adding nonce(number used once) to all scripts that it loads.
• CSP Hash Generator - Script and style hasher for script-src and style-src directives to disallow inline scripts and styles. More here.
• CSP Evaluator - Paste your policy and check if its safe and strong enough.
• CSP WTF? - Explanations for strange CSP Report notifications.
• `csp-html-webpack-plugin` - Generates meta content for your Content Security Policy tag.
• CSP Tester - Browser extension for testing Content Security Policy (CSP).
• CSP Header Inspector - Validate your policies as served from the given URL.

Serializers

• Security Headers - Check your website's HTTP response headers for security.

Other lists

X-Frame-Options

• Awesome Web Security - A curated list of Web Security materials and resources.
• CSP useful - A collection of parsers, examples and tips for Content Security Policy.