Using Web Search

Use this skill when researching best practices, tutorials, and expert opinions using WebSearch and WebFetch tools.

Core Principles

• Search with specific, current queries
• Fetch promising results for detailed analysis
• Assess source authority and recency
• Synthesize findings with citations

Workflow

1. Craft Search Query

Be specific and current:

# ❌ Vague
WebSearch(query="authentication best practices")

# ✅ Specific
WebSearch(query="OAuth2 JWT authentication Node.js 2024")

Query patterns:

• Technology + use case + year: "React server-side rendering 2024"
• Problem + solution: "avoid N+1 queries GraphQL"
• Comparison: "REST vs GraphQL microservices 2024"
• Pattern: "repository pattern TypeScript best practices"

Account for current date:

• Current date from : Check "Today's date"
• Use current/recent year in queries
• Avoid outdated year filters (e.g., don't search "2024" if it's 2025)

2. Domain Filtering

Include trusted sources:

# Focus on specific domains
WebSearch(
    query="React performance optimization",
    allowed_domains=["react.dev", "web.dev", "kentcdodds.com"]
)

Block unreliable sources:

# Exclude low-quality sites
WebSearch(
    query="TypeScript patterns",
    blocked_domains=["w3schools.com", "tutorialspoint.com"]
)

Trusted sources by category:

Frontend:

• react.dev, web.dev, developer.mozilla.org
• kentcdodds.com, joshwcomeau.com, overreacted.io

Backend:

• martinfowler.com, 12factor.net
• fastapi.tiangolo.com, docs.python.org

Architecture:

• microservices.io, aws.amazon.com/blogs
• martinfowler.com, thoughtworks.com

Security:

• owasp.org, auth0.com/blog, securityheaders.com

3. Fetch and Analyze

Use WebFetch for detailed content:

# Fetch specific article
content = WebFetch(
    url="https://kentcdodds.com/blog/authentication-patterns",
    prompt="Extract key recommendations for authentication patterns, including code examples and security considerations"
)

Fetch prompt patterns:

• "Extract key recommendations for [topic]"
• "Summarize best practices with code examples"
• "List security considerations and common pitfalls"
• "Compare approaches mentioned with pros/cons"

4. Authority Assessment

Evaluate sources:

Source: Kent C. Dodds - Authentication Patterns (2024)
Authority: ⭐⭐⭐⭐⭐
- Industry expert, React core contributor
- Recent publication (Jan 2024)
- Cited by 50+ articles
- Production examples from real apps

Authority indicators:

• ✅ Known experts in field
• ✅ Official documentation
• ✅ Recent publication dates
• ✅ Specific, detailed examples
• ✅ Acknowledges trade-offs

Red flags:

• ❌ No author/date
• ❌ Generic advice without context
• ❌ No code examples
• ❌ Outdated libraries/patterns
• ❌ Copy-pasted content

Reporting Format

Structure findings as:

## Web Research Findings

### 1. Authentication Best Practices

**Source:** Auth0 Blog - "Modern Authentication Patterns" (2024-10-15)
**Authority:** ⭐⭐⭐⭐⭐ (Official security vendor documentation)
**URL:** https://auth0.com/blog/authentication-patterns

**Key Recommendations:**

1. **Token Storage**
   > "Never store tokens in localStorage due to XSS vulnerabilities. Use httpOnly cookies for refresh tokens."

   - ✅ Refresh tokens → httpOnly cookies
   - ✅ Access tokens → memory only
   - ❌ localStorage for sensitive data

2. **Token Rotation**
   ```javascript
   // Recommended pattern
   const rotateToken = async (refreshToken) => {
     const { access, refresh } = await api.rotate(refreshToken)
     invalidateOldToken(refreshToken)
     return { access, refresh }
   }

Trade-offs:

• Memory-only tokens lost on refresh (need refresh flow)
• HttpOnly cookies require CSRF protection
• Complexity vs. security balance

---

2. Performance Optimization

Source: web.dev - "React Performance Guide" (2024-08) Authority: ⭐⭐⭐⭐⭐ (Google official web platform docs) URL: https://web.dev/react-performance

Findings:

1. Code Splitting

   • Lazy load routes: 40% faster initial load
   • Use React.lazy() + Suspense
   • Combine with route-based splitting

2. Memoization Strategy

   • useMemo for expensive computations (>16ms)
   • useCallback only when passed to memoized children
   • Don't over-optimize - measure first

Benchmarks cited:

• Code splitting: 2.1s → 1.3s load time
• Proper memoization: 15% render reduction

## Search Strategies

### Pattern Discovery
```python
WebSearch(query="factory pattern TypeScript best practices 2024")

Problem Solutions

WebSearch(query="prevent race conditions React useEffect")

Technology Comparisons

WebSearch(query="Prisma vs TypeORM PostgreSQL 2024")

Migration Guides

WebSearch(query="migrate Express to Fastify performance")

Anti-Patterns

❌ Don't: Search without year context ✅ Do: Include current year for recent practices

❌ Don't: Accept first result without verification ✅ Do: Fetch 2-3 sources, compare findings

❌ Don't: Copy recommendations without understanding ✅ Do: Synthesize findings, note trade-offs

❌ Don't: Skip source credibility check ✅ Do: Assess authority, recency, specificity

Citation Format

Always cite findings:

**Recommendation:** Use dependency injection for testability

Source: Martin Fowler - "Inversion of Control Containers" (2023)
URL: https://martinfowler.com/articles/injection.html
Authority: ⭐⭐⭐⭐⭐ (Industry thought leader, 20+ years)

Quote: "Constructor injection makes dependencies explicit and enables testing without mocks."

Example Session

# 1. Search for auth patterns
results = WebSearch(
    query="JWT refresh token rotation Node.js 2024",
    allowed_domains=["auth0.com", "oauth.net"]
)
# → Found 5 articles from Auth0, OAuth.net

# 2. Fetch most promising
article1 = WebFetch(
    url="https://auth0.com/blog/refresh-tokens-rotation",
    prompt="Extract token rotation implementation patterns and security considerations"
)
# → Got detailed rotation strategy with code

# 3. Fetch second source for comparison
article2 = WebFetch(
    url="https://oauth.net/2/refresh-tokens/",
    prompt="Summarize OAuth2 refresh token best practices"
)
# → Got official OAuth2 spec recommendations

# 4. Search for implementation gotchas
gotchas = WebSearch(
    query="JWT refresh token common mistakes pitfalls"
)
# → Found 3 articles on common errors

# 5. Synthesize findings
# Compare sources, note consensus vs. disagreement
# Highlight trade-offs and context-specific advice

Quality Indicators

High-quality findings have:

• ✅ Multiple authoritative sources agree
• ✅ Publication dates within last 2 years
• ✅ Specific code examples with explanation
• ✅ Acknowledges trade-offs and context
• ✅ Cites benchmarks or case studies

Reconsider if:

• ❌ Only one source found
• ❌ Sources conflict without explanation
• ❌ Generic advice without specifics
• ❌ Outdated patterns (>3 years old for web)
• ❌ No consideration of modern alternatives