Frontend Security Boundary

The foundational point, stated because it is violated constantly: client-side code is under the user's control. Validation, authorisation checks, hidden fields, disabled buttons and obfuscated logic are user experience features. Every one of them can be bypassed with the browser's own tools, and any check that matters must be repeated on the server.

Within that constraint, the browser-side mechanisms that genuinely reduce risk are worth understanding as architecture rather than configuration. A Content Security Policy restricts which sources may execute script, which is the strongest single mitigation against cross-site scripting and against a compromised third-party tag — and it is also the one most often deployed in a permissive form that provides nothing. SameSite cookies and anti-forgery tokens address cross-site request forgery. Subresource integrity ensures a third-party script has not been altered. HttpOnly cookies keep session tokens out of reach of injected script, which is the argument against storing tokens in local storage that many single-page applications lose.

The risk area that has grown fastest is the third-party supply chain. A marketing tag loaded on the checkout page executes with full page privileges and can read every field, which is the mechanism behind a long series of card-skimming compromises. Treating third-party scripts as untrusted code running inside your most sensitive page is the correct posture, and a strict policy plus isolation is the only real defence.