Frontend Labs
⋯
Read as one page Original HTML edition ↗ Markdown source ↗

Appendix E: Further reading

Organized to mirror the guide's Parts, so you can go deep on exactly the topic you just read, rather than a flat undifferentiated list.

E.1 — Language fundamentals (Part I–II)

  • ECMA-262 (tc39.es/ecma262) — the actual, current ECMAScript specification. Dense, but it is the only fully authoritative source when MDN's prose and a language edge case disagree; worth learning to navigate even if you never read it cover to cover.
  • TC39 proposals repo (github.com/tc39/proposals) — track upcoming language features by stage (0–4) before they ship; the fastest way to know whether a syntax you saw in a blog post is real, experimental, or abandoned.
  • MDN JavaScript Guide & Reference (developer.mozilla.org/en-US/docs/Web/JavaScript) — the canonical day-to-day reference for every built-in, operator, and method in Part I; also the best browser-compatibility data source (the "Browser compatibility" table at the bottom of every page).
  • "You Don't Know JS (Yet)" by Kyle Simpson — a free, open-source book series (github.com/getify/You-Dont-Know-JS) that goes deeper than this guide specifically on scope/closures, this/prototypes, and async — the natural next stop after Part I-II if any single chapter here felt rushed.
  • "Eloquent JavaScript" by Marijn Haverbeke (eloquentjavascript.net, free online) — a slower-paced, project-driven alternative path through the same fundamentals, with a stronger emphasis on writing real programs early.
  • 2ality blog by Dr. Axel Rauschmayer (2ality.com) — the most reliable ongoing source of precise, spec-accurate deep dives on individual language features (destructuring, iterators, generators, Symbol.iterator) as they ship.
  • "Tasks, microtasks, queues and schedules" by Jake Archibald (jakearchibald.com) — the single canonical explainer for §12's event-loop task/microtask ordering, written by a browser engineer who worked on the spec text itself; read this if §12's ASCII diagram wasn't enough.

E.2 — Browser internals and rendering (Part III, V)

  • "How Browsers Work: Behind the scenes of modern web browsers" by Tali Garsiel and Paul Irish (originally HTML5Rocks, mirrored on web.dev) — the classic, exhaustive walkthrough of the rendering pipeline this guide's §21 summarizes; covers parsing algorithms and layout in far more depth.
  • "Inside look at modern web browser" (4-part series, Chrome team, developer.chrome.com) — walks the exact multi-process architecture from §18 (browser process, renderer process, compositor, GPU process) with diagrams from the people who built Chromium's implementation.
  • Chromium project design docs (chromium.org → Developer documentation) — primary-source design documents for site isolation, the compositor, and Blink's rendering pipeline, for when a blog-post-level explanation isn't precise enough.
  • Mozilla Hacks (hacks.mozilla.org) — Gecko/SpiderMonkey engineering team's own blog; the best source for why Firefox's engine made a different architectural choice than Chromium on a given feature (§19).
  • WebKit Blog (webkit.org/blog) — same role for Safari/JavaScriptCore; cross-reference all three engine blogs when debugging a real cross-browser rendering discrepancy rather than guessing from behavior alone.
  • web.dev's Rendering Performance guide (web.dev → Learn → Rendering Performance) — a practical companion to §21-22's layout/paint/composite pipeline, with more CSS-property-by-property "what triggers what" detail.

E.3 — HTTP, networking, and browser transport (Part IV)

  • "High Performance Browser Networking" by Ilya Grigorik — free online (hpbn.co) and in print; the definitive deep dive on TCP, TLS, HTTP/1.1, HTTP/2, and mobile network behavior from a browser-performance angle, written by a Google engineer who worked on the relevant Chrome subsystems.
  • "http2 explained" and "http3 explained" by Daniel Stenberg (curl's author) — free ebooks (github.com/bagder) that go far deeper into the wire-level framing/multiplexing mechanics §26 only summarizes.
  • MDN HTTP docs (developer.mozilla.org/en-US/docs/Web/HTTP) — the canonical reference for every header, status code, and caching directive used across Part IV.
  • web.dev's "Fast load times" guide (web.dev → Learn → Performance) — practical resource-hint (preconnect/preload/prefetch) guidance extending §26.
  • wiki/networking/tcp-ip/real-life-example.md — this wiki's own networking companion guide for the TCP/TLS/DNS mechanics underneath every fetch() call in Part IV, in full depth.
  • wiki/scale-perf/real-life-scale-guide.md — once an endpoint built with Part IV's fetch patterns is live, this wiki's load-testing/latency-percentile guide covers how to actually measure and stress-test it under real traffic.

E.4 — Concurrency and multi-threaded browser apps (Part VI)

  • MDN Web Workers API and MDN "Using web workers" guide — the canonical reference and tutorial for §38's postMessage/structured-clone mechanics.
  • web.dev's cross-origin isolation guide (web.dev → search "COOP COEP") — the practical, up-to-date checklist for enabling SharedArrayBuffer (§39), including common misconfigurations that leave it silently disabled.
  • Comlink by Surma/GoogleChromeLabs (github.com/GoogleChromeLabs/comlink) — the actual RPC-over-postMessage library §41 describes the pattern of; read its README and source (it's small) to see the Proxy-based trick that makes worker calls look synchronous-ish.
  • Surma's blog (surma.dev) — sustained, practical writing on Web Workers, WASM threads, and offloading architecture from one of the engineers who built much of the tooling in this space.
  • "Is postMessage slow?" and related perf-focused posts on web.dev/developer.chrome.com — for when a worker-pool architecture's message-passing overhead itself becomes the bottleneck.

E.5 — Client-side storage and encryption (Part VII)

  • W3C Web Cryptography API specification (w3.org/TR/WebCryptoAPI) — the formal spec behind every crypto.subtle call in §46; useful for confirming exact algorithm parameter names/shapes across browsers.
  • MDN Web Crypto API, Web Storage API, and IndexedDB API references — the day-to-day lookup for the exact method signatures used in §44-46.
  • idb by Jake Archibald (github.com/jakearchibald/idb) — the de facto standard Promise-based wrapper around raw IndexedDB (§45); reading its source is the fastest way to understand the transaction lifecycle edge cases the raw callback API hides.
  • OWASP Cheat Sheet Series (cheatsheetseries.owasp.org) — specifically the Cryptographic Storage, XSS Prevention, and Content Security Policy cheat sheets, the authoritative source behind §47 and §51's security guidance.
  • wiki/security/real-life-guide.md — this wiki's security guide goes much deeper on the cryptographic primitives themselves (key sizes, algorithm selection trade-offs, PKI) that §46 only introduces at the API-usage level.

E.6 — Engine internals and browser security (Part VIII)

  • V8 blog (v8.dev/blog) — primary-source posts from the V8 team on Ignition, Sparkplug, TurboFan, and hidden-class/inline-cache mechanics (§49), written by the engineers who implemented them.
  • "A tour of V8" series by Vyacheslav Egorov (mrale.ph) — an independent, unusually detailed technical dive into V8's object representation and garbage collector, referenced widely in the JS-engine community.
  • "Ignition: Jump-starting an interpreter" (V8 blog) — the specific design-rationale post for why V8 added a bytecode interpreter tier at all, directly extending §49's pipeline diagram.
  • Spectre attack reference site and original paper (spectreattack.com) — the primary source for §51's speculative-execution side-channel discussion, including the original PoC code.
  • Chromium Site Isolation design docs (chromium.org → Chromium Security → Site Isolation) — the concrete engineering response to Spectre described at a high level in §18/§51.
  • web.dev's Content Security Policy guide — practical CSP-authoring guidance (directive-by-directive) extending §51's policy example.

E.7 — Modern JavaScript (Part X)

  • TC39 finished proposals (github.com/tc39/proposals/blob/main/finished-proposals.md) — which feature landed in which edition; check here before trusting a blog post about "ES2026".
  • "Exploring JavaScript" by Axel Rauschmayer (exploringjs.com) — free, current, spec-accurate coverage of iterators, Proxies and every recent edition.
  • Temporal documentation (tc39.es/proposal-temporal/docs) — the cookbook is the fastest way to unlearn Date.
  • MDN Streams API — the guide to ReadableStream/TransformStream and backpressure that §54 builds on.

E.8 — AI in the browser and agents (Part XI)

  • WebLLM (webllm.mlc.ai, github.com/mlc-ai/web-llm) — docs, the prebuilt model list and examples, including service-worker engines.
  • Transformers.js (huggingface.co/docs/transformers.js) — supported tasks and models, WebGPU and quantization options.
  • WebGPU Fundamentals (webgpufundamentals.org) — the best step-by-step path from §57's vector add to real compute and rendering.
  • Chrome built-in AI docs (developer.chrome.com/docs/ai) — current status of the Summarizer, Translator, Prompt and Writer APIs.
  • AG-UI (docs.ag-ui.com), A2UI (Google's announcement and spec) and the MCP specification (modelcontextprotocol.io, including MCP Apps) — the protocols behind §61.
  • wiki/AI-ML/real-life-ai-example-v1.md — this wiki's AI guide: how the models behind these APIs work, from zero to LLMs and agent harnesses.

E.9 — Security and authentication (Part XII)

  • OWASP Top 10:2025 (owasp.org/Top10/2025) and OWASP Top 10 for LLM Applications (genai.owasp.org) — the two lists §64 maps.
  • OWASP Cheat Sheet Series — DOM-based XSS Prevention, CSRF Prevention, Session Management, Authentication, OAuth2.
  • web.dev: "Mitigate cross-site scripting with a strict CSP" and "Prevent DOM-based XSS with Trusted Types" — the rollout guides for §65's policies.
  • IETF "OAuth 2.0 for Browser-Based Applications" — the source of the BFF recommendation in §67.
  • passkeys.dev and SimpleWebAuthn (simplewebauthn.dev) — passkey UX patterns and a maintained server-side verifier.

E.10 — Open-source internals (Part XIII)

  • Preact source (github.com/preactjs/preact, src/ and hooks/src/) and Preact Signals (github.com/preactjs/signals, packages/core).
  • "Build your own React" by Rodrigo Pombo (pomb.us/build-your-own-react) — the Fiber-style counterpart to §70's Preact reading.
  • TC39 Signals proposal (github.com/tc39/proposal-signals) — the design discussion behind §71, with a polyfill.
  • Zustand (github.com/pmndrs/zustand) and Hono (github.com/honojs/hono, src/router/).

E.11 — Testing (Part XIV)

  • Playwright docs (playwright.dev) — especially Best Practices, Authentication, Mock APIs, Clock, Aria snapshots and Sharding.
  • Testing Library's guiding principles (testing-library.com) — the reasoning behind role-based locators.
  • axe-core rules (dequeuniversity.com/rules/axe) — what each accessibility violation means and how to fix it.

E.12 — Performance and debugging (Part XV)

  • web.dev Core Web Vitals (web.dev/articles/vitals) and the web-vitals library source — the reference implementation of §83's algorithms.
  • Chrome DevTools docs (developer.chrome.com/docs/devtools) — Performance panel, Memory panel, custom tracks with User Timing.
  • Long Animation Frames API explainer (developer.chrome.com/docs/web-platform/long-animation-frames) — INP attribution in production.

Books worth owning

  • You Don't Know JS (Yet) — Kyle Simpson (free online, also in print).
  • Eloquent JavaScript — Marijn Haverbeke (free online, also in print).
  • JavaScript: The Definitive Guide — David Flanagan (O'Reilly) — the closest thing to a comprehensive paper reference for the whole language.
  • High Performance Browser Networking — Ilya Grigorik (free online, O'Reilly in print) — Part IV's networking material, in full depth.
  • Secrets of the JavaScript Ninja — John Resig & Bear Bibeault — closures, this, and DOM/event internals with the same "how does this actually work" angle as Part I-III of this guide.

This wiki's companion guides

Generated from real-life-JS-guide.md · 8 Oct 2026 16:36