YerevanJS Meetup #1

Azat Davliatshin, Software Architect & Tech Lead at Quantori, author of the open-source library next-auth-bridge, which handles silent SSO for Next.js apps embedded in SharePoint, Teams, Salesforce, and Confluence. Azat has spent more than 10 years in JavaScript — from frontend to distributed systems architecture. Your Next.js app is embedded in SharePoint, Teams, or a corporate portal. The user is already signed in on the host side, but inside your iframe they're anonymous: Safari and Firefox don't share third-party cookies by default, and Chrome cuts them in incognito mode and under corporate policies. Signing in again ruins the UX. The Storage Access API shows the user a prompt. CHIPS cookies don't inherit the session on their own. And vendor SDKs lock you into someone else's identity provider. We'll break down the "bridge" pattern: a popup in the top-level context, a one-time code instead of a token, and a partitioned cookie on the other side. Azat will show the invariants without which the bridge turns into a hole, and how the same design maps onto Auth.js and Better Auth with a two-line difference.Read more →

Gagik Papikyan, Senior Software Engineer at DataArt. He started out as a full-stack developer, then moved into backend, and along the way has worn every hat — from individual contributor to team lead, and even startup co-founder. Object Prototype Pollution is a JavaScript vulnerability that occurs when an attacker is able to modify properties of the base object prototype. Since almost every object in JavaScript inherits from this shared prototype, injecting or overwriting properties on it can change the behavior of the entire application at once. Protection is built around safe practices: validating and sanitizing input keys, freezing prototypes, and using safer data structures.Read more →

Dmitry Shmakov, Lead Product Engineer at Neverless and one of the organizers of MoscowJS. He works on web performance and modern web technologies. Outside of work, he loves traveling to unusual places, trail running, and photography. Websites were originally built for people — we read pages, look for buttons, and fill in forms. When an AI agent takes over, it has to reconstruct the meaning of the interface from the DOM, text, and pixels. Because of this, even small changes on a page can break a scenario. WebMCP offers a different approach: a page can explicitly describe its actions for the agent — how to find a product, pick an available time slot, create a task, or cancel a booking. Humans keep using the familiar interface, while the agent gets tools with clear names, parameter schemas, and structured results. In this talk we'll look at how WebMCP differs from an MCP server, why it can reduce the number of errors and the cost of agent scenarios, how the design of web applications changes, and what security questions arise when a site exposes its actions to machines. And how you can add this technology to your own site today.Read more →