07. References, Standards & Technical Resources
This chapter provides an exhaustive catalog of official specifications, industry standards, RFC documents, OWASP cheat sheets, real-world CVE case studies, and security tooling references.
📜 Official W3C Specifications & RFC Standards
-
W3C Content Security Policy Level 3 Specification
Official W3C recommendation for CSP v3, detailing nonces, hashes,'strict-dynamic', and policy processing rules.
https://w3c.github.io/webappsec-csp/ -
W3C Trusted Types API Specification
W3C specification establishing browser-level type safety for DOM execution sinks to prevent DOM-based XSS.
https://w3c.github.io/trusted-types/dist/spec/ -
W3C Subresource Integrity (SRI)
Official W3C specification defining script and stylesheet cryptographic hash verification.
https://www.w3.org/TR/SRI/ -
RFC 7636: Proof Key for Code Exchange (PKCE)
IETF RFC establishing OAuth 2.0 authorization code flow security for public client applications (SPAs & Mobile).
https://datatracker.ietf.org/doc/html/rfc7636 -
RFC 6265bis: Cookie SameSite Processing Controls
Updated IETF specification for state management cookies, definingSameSite=Strict/Lax/Noneand cookie prefixes (__Host-,__Secure-).
https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-rfc6265bis
📚 OWASP Guidelines & Cheat Sheets
-
OWASP Client-Side Security Cheat Sheet
Comprehensive guidelines on browser storage mechanics, data isolation, and DOM architecture hardening.
https://cheatsheetseries.owasp.org/cheatsheets/HTML5_Security_Cheat_Sheet.html -
OWASP Cross-Site Scripting (XSS) Prevention Cheat Sheet
Context-aware encoding rules, escaping contexts, and HTML sanitization guidelines.
https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html -
OWASP DOM-Based XSS Prevention Cheat Sheet
Detailed mapping of browser DOM sources, sinks, and sanitization patterns.
https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html -
OWASP Authorization Code Flow with PKCE Cheat Sheet
Best practices for single-page applications integrating OAuth 2.0 and OpenID Connect (OIDC).
https://cheatsheetseries.owasp.org/cheatsheets/OAuth2_Cheat_Sheet.html
🔍 Notable Real-World CVEs & Case Studies
| Vulnerability / Incident | Affected Technology | Vector & Mechanism | Impact & Takeaway |
|---|---|---|---|
| CVE-2020-11022 / CVE-2020-11023 | jQuery (< 3.5.0) | DOM XSS via htmlPrefilter executing unescaped elements during internal parsing | Triggered XSS even when passing sanitized strings to $(). Enforced mandatory jQuery upgrades across millions of web applications. |
| CVE-2021-23337 | Lodash (< 4.17.21) | Client-Side Prototype Pollution via template / merge functions | Injected properties into Object.prototype, allowing attackers to bypass configuration options and execute DOM XSS. |
| CVE-2022-25883 | DOMPurify (< 2.3.10) | Mutation XSS (mXSS) bypass involving nested HTML5 element parsing | Highlighted the danger of browser DOM tree mutations after sanitization. Required patching DOMPurify's internal parser logic. |
| Magecart British Airways Incident | Feedify 3rd-Party Script | Supply chain compromise of third-party analytics script loaded via CDN | Attackers injected 22 lines of JavaScript to skim 380,000 credit card details. Proved the necessity of SRI hashes and strict CSP. |
🛠️ Security Tooling & Evaluation Utilities
-
DOMPurify
Ultra-fast, XSS sanitizer for HTML, MathML, and SVG.
https://github.com/cure53/DOMPurify -
Google CSP Evaluator
Automated tool for analyzing Content Security Policy headers for bypass vulnerabilities and misconfigurations.
https://csp-evaluator.withgoogle.com/ -
Retire.js
Vulnerability scanner targeting client-side JavaScript libraries.
https://retirejs.github.io/retire.js/ -
Semgrep SAST Engine
AST-based static code analyzer for custom frontend security rule enforcement.
https://semgrep.dev/ -
Mozilla HTTP Observatory
Free security suite inspecting HTTP response headers, CSP, and SSL configurations.
https://observatory.mozilla.org/