Milestones 1 to 7 let the Kladde grow. Every pull request had its keyboard check and its review, as the definition of done demands. Still, gaps remain, typically at the edges: in states that rarely came up while building, on pages somebody else built, in responses that aren’t pages. The eighth milestone checks the whole Kladde at once, once through the eyes of the people who use it and once through those of an attacker.
At the end there are two reports in docs/ and a few small pull requests with fixes and tests.
| Pull request | Branch | Brings | Where in this lesson |
|---|---|---|---|
| 1 | docs/m8-accessibility-report |
the audit report over all pages and states; the fixes follow as small pull requests of their own | “Pull request 1” and exercise 1 |
| 2 | feature/m8-security-headers |
three security headers on every response, the nonce for the import map | “Pull request 2” and exercise 2 |
| 3 | feature/m8-nuget-audit |
NuGet Audit without findings, one transitive dependency raised | “Pull request 3” |
| 4 | docs/m8-threat-list |
the threat list with a measure, a test or a reason for each category | exercise 3 |
Where the Kladde stands
After modules 2.1 to 2.6 and milestones 1 to 7, the solutions have this:
docs/accessibility.mdhas findings and fixes from lesson 2.1.7, then for the prototype. Since then, every new page has been checked with the keyboard, but not all together and not in all states.- From lesson 2.6.5 there’s a content security policy, from lesson 2.6.6 the threat list (
docs/threat-list.md), the booking’s rate limiter, and NuGet Audit as an error in the build. App.razorcontains, as in lesson 2.5.1,<ImportMap />, the stylesheet through@Assets[…]andblazor.web.js.
If your files, classes or folders have other names, keep yours and carry the steps over.