Tag: JavaScript

1. CSRF Protection in Single Page Apps: Combining Tokens, SameSite and Fetch

   Sep 4, 2025

   Cross Site Request Forgery is considered a solved problem by many teams the moment an application moves to a single page architecture with fetch instead of classic forms. In reality the risk merely shifts as long as session cookies are involved in authenticated API calls, and it stays real, requiring a deliberate combination of double submit cookie, the SameSite attribute and custom headers.

   Read more

2. Property-Based Testing in JavaScript with fast-check

   Sep 4, 2025

   Classic unit tests check individual, hand-picked examples. Property-based testing flips that around: instead of writing examples, you define properties that must hold for every valid input, then let fast-check generate thousands of random cases to uncover exactly the edge cases a human writing tests by hand tends to overlook.

   Read more

3. AbortSignal.timeout() and AbortSignal.any() Explained

   Aug 25, 2025

   AbortSignal.timeout() replaces the manual setTimeout plus AbortController combination with a single expression, and AbortSignal.any() merges multiple cancellation sources into one signal. Together, both methods solve one of the most stubborn boilerplate problems in modern fetch based applications.

   Read more

4. Web Components Without a Framework: Reusable UI Building Blocks in Plain JavaScript

   Aug 19, 2025

   Web Components are a group of native browser APIs for building encapsulated UI building blocks that work without a framework runtime. Custom Elements, Shadow DOM and HTML Templates enable components that work equally well in React, Vue, Angular and plain HTML, a strong fit for design systems that span team and stack boundaries.

   Read more

5. Sandboxed iframes and postMessage Security: Isolation Without Losing Functionality

   Aug 11, 2025

   Embedded third party content such as payment widgets, ad banners or comment systems runs in the same document as your own application and, without consistent isolation, poses a substantial security risk. The sandbox attribute on iframe elements and strict origin checking in postMessage communication enable genuine isolation without blocking the actual functionality of embedded widgets.

   Read more

6. JavaScript Event Loop, Microtasks and Macrotasks Explained

   Aug 3, 2025

   JavaScript is single-threaded, but not sequential. The Event Loop determines the execution order of synchronous code, Promises, timers and callbacks. Anyone who does not understand the difference between microtasks and macrotasks ends up writing asynchronous code that runs in a mysteriously wrong order.

   Read more

7. structuredClone(): Native Deep Cloning in JavaScript at Last

   Aug 2, 2025

   The JSON roundtrip trick has been the standard for deep cloning in JavaScript for years, and for years it has been losing Date objects, Map, Set, undefined values and circular references. structuredClone() is the native solution that has been available in all modern engines since 2022 and handles all of that correctly.

   Read more

8. Building Your Own Signals Library: Reactivity Without Framework Lock-in

   Aug 1, 2025

   Signals are a reactivity pattern that Vue, Solid, Preact and Angular implemented independently of each other, yet all rely on the same few building blocks. Anyone who understands how a minimal signals system built from getters, setters and automatic dependency tracking works can use reactivity in any vanilla JavaScript project, with no framework dependency at all.

   Read more

9. File System Access API in Practice: Reading and Writing Files Directly in the Browser

   Jul 26, 2025

   The File System Access API gives web applications real read and write access to local files and folders, without the classic detour through uploads and downloads. Anyone building editors, image tools or data exports in the browser gets behavior that feels almost like a native desktop application, including a permission model and persistent handles.

   Read more

10. Mocking Fetch and Network Calls in Tests with MSW

    Jul 18, 2025

    Anyone who simply overwrites globalThis.fetch in unit tests builds fragile mocks that need adjusting with every code change. Mock Service Worker instead intercepts network requests at the HTTP level, exercises the real fetch call, and can be configured precisely for both success and error cases without touching the application code itself.

    Read more