XSS and output encoding, CSP and headers, auth, sessions and CSRF, server-side risks, supply chain and dependency hygiene.
Pages
- XSS and output encodingThe three kinds of cross-site scripting, exactly what Vue escapes and what it does not, the sinks to watch — v-html, href and src schemes, style bindings, user templates, JSON in script tags, SVG uploads, postMessage — sanitisation with DOMPurify on both sides, Trusted Types, and how CSP limits the blast radius.
- CSP and security headersContent Security Policy in practice — directives, nonces versus hashes versus strict-dynamic, report-only rollout, how Nuxt's inline payload and scripts interact with it and what nuxt-security automates — plus HSTS, nosniff, Referrer-Policy, Permissions-Policy, frame-ancestors, the cross-origin isolation headers and subresource integrity.
- Authentication, sessions and CSRFServer sessions versus stateless sealed cookies versus JWTs and where each breaks, OAuth 2.1 and OIDC with PKCE, passkeys, password hashing and login hardening, CSRF defences from SameSite to origin checks and tokens, and authorisation done on the server for every object.
- Server-side risks in Nitro routesInjection and parameterised queries, SSRF through user-supplied URLs and image proxies, path traversal, prototype pollution, ReDoS, open redirects, file uploads, secrets and configuration, error handling that does not leak, logging without PII, timing-safe comparisons, webhooks, and denial-of-service by unbounded input.
- Supply chain and dependency hygieneWhat the 2025 npm attacks changed, OWASP's new supply-chain category, lockfiles and frozen installs, pnpm's release-age delay and blocked install scripts, provenance and trusted publishing, update automation with cooldowns, CI with least privilege, SBOMs, and how to keep Nuxt and its ecosystem patched.
Notes for the whole section