HTTP, tokens, meta tags, cron, and API workflows.
Protocols and tokens you touch daily — JWT structure, HTTP semantics, cron schedules, and the security boundary between client and server.
What browser tools can show you, and what must stay on the backend.
Topics covered
Get Content-Type right for APIs, file uploads, and static assets — charset parameters, multipart boundaries, sniffing risks, and a practical MIME lookup workflow.
Named and numeric HTML entities, when to encode, XSS pitfalls, and how entity lookup pairs with MIME awareness when pasting content into HTML and email.
Decode UUID and ULID strings to read version bits, variants, and timestamps — a practical debugging guide for APIs, logs, and database keys.
Learn when Base58 beats Base64 — alphabet rules, leading-zero handling, checksum variants, and how to encode or decode safely in the browser.
How HMAC signatures protect webhooks — canonical message construction, hex vs Base64 encodings, timing-safe comparison concepts, and building reliable test fixtures.
CIDR notation explained for frontend and full-stack developers — private ranges, VPC subnets, localhost quirks, and how to read /24 vs /16 without memorizing the whole CCNA.
How password entropy works, why character sets matter, when browser CSPRNG is enough, and why generated passwords are not a substitute for proper password storage hashing.
Break down URL parts, encode query values correctly, and know when to use encodeURIComponent vs encodeURI — plus reserved characters that break APIs.
Use AES-GCM with Web Crypto for demos and learning, understand IV and auth tags, and know why inventing browser-only crypto protocols fails in production.
Turn OpenAPI operations into accurate curl commands, attach auth headers correctly, and use snippets to reproduce frontend API failures for backend teammates.
Learn SHA-1/256/384/512 in the browser, the difference between checksums and password hashing, how Web Crypto digests work, and when HMAC belongs in your frontend workflow.
Understand browser CORS, OPTIONS preflight, Access-Control-Allow-Origin, and credentials mode — plus the SPA misconfigurations that waste hours in production debugging.
How time-based one-time passwords work — shared Base32 secrets, 30-second windows, HMAC algorithms, clock skew, and why browser TOTP tools are for test secrets only.
Configure CSP for single-page apps — script-src with nonces and hashes, common React and Vite failures, CORS interplay, reporting, and a practical rollout checklist.
A practical guide to robots.txt — syntax, common mistakes, how to check and validate your file, and when Disallow blocks indexing vs crawling.
How to convert Unix epoch seconds and milliseconds, read JWT exp claims, format ISO-8601 correctly, and avoid DST and timezone bugs in APIs and frontends.
A practical guide to Base64 and Base64url on the web — encoding binaries for data URLs and Authorization headers, padding rules, size costs, and when client-side tools keep secrets offline.
A complete guide to cron syntax — the five fields, special characters, real-world examples, and the timezone, day-of-week, and non-standard pitfalls that silently break schedules.
Parse request and response headers, understand Set-Cookie attributes, and avoid User-Agent sniffing traps — with practical debugging workflows for APIs and browsers.
A practical comparison of UUID, ULID, and Nano ID — sortability, index performance, collision odds, and URL safety — so you can pick the right ID format for your database, API, and URLs.
Decoding a JWT is not verifying it. Learn how signature verification works, the alg:none and algorithm-confusion attacks to avoid, which claims to check, and how to inspect tokens safely in development.
A practical guide to consuming REST APIs in frontend applications — HTTP methods, status codes, fetch patterns, authentication, error handling, and debugging techniques.
A deep dive into JSON Web Token structure, signing algorithms, common vulnerabilities, and a safe workflow for decoding tokens in development without exposing production secrets.
Find a developer tool