Web apps that load fast, pass an accessibility audit and sign people in safely.
Picture a customer portal that takes six seconds to show a balance, can't be used with a keyboard and still keeps passwords in its own database table. We fix those three things first on any web project, then build the features.
Identity platformAuth0 · Okta · Entra IDMFA and passkeysWebAuthn
03 · Portal
Web applicationReact · Next.js · .NETBackend for frontendsession · token handlingReal-user monitoringCore Web Vitals · INP
04 · Business systems
CRMSalesforce Experience dataERPorders · invoices
Auth0OktaMicrosoft Entra IDSalesforce
in short·15-second read
Web development at Cohash means designing, building and maintaining customer portals, internal tools and public sites, then keeping them current.
We build to WCAG 2.2 AA, measure Core Web Vitals including Interaction to Next Paint, and hand sign-in to an identity platform such as Auth0, Okta or Entra ID over OpenID Connect instead of storing passwords in the application.
you probably need this if
The customer portal stores its own password table and handles resets by email.
An accessibility complaint or audit found the site fails WCAG checks.
Pages feel slow on phones and Interaction to Next Paint scores are poor.
From the first call to a setup your own team can run.
Here's what usually prompts a call about your Web Development, what we do about it and in which order, and where you end up.
01 · where it hurts02 · what we change03 · how it runs04 · where you end up
incident board · web development3 open
openThe customer portal stores its own password table and handles resets by email.
recurringAn accessibility complaint or audit found the site fails WCAG checks.
blockedPages feel slow on phones and Interaction to Next Paint scores are poor.
exposure
Customer and partner portalsAccessibility to WCAG 2.2 AAPerformance you can measureSign-in handled by an identity…Framework and runtime upgrades
startrehearsehandover
Discovery
Design and prototype
Build in increments
Launch and support
we are here
ready to hand over
The core flows work with a keyboard and a screen reader now, and the agency has a…
Taps on the dashboard respond without the freezes users complained about, and the budget…
Partners serve themselves and manage their own users.
Prototype and design system components
chapter 01 · where it hurts
Why teams reach out
The customer portal stores its own password table and handles resets by email.
An accessibility complaint or audit found the site fails WCAG checks.
Pages feel slow on phones and Interaction to Next Paint scores are poor.
chapter 02 · what we change
How we solve it
Customer and partner portals
Accessibility to WCAG 2.2 AA
Performance you can measure
Sign-in handled by an identity platform
Framework and runtime upgrades
chapter 03 · how it runs
Our approach
Discovery
Design and prototype
Build in increments
Launch and support
chapter 04 · where you end up
What changes
The core flows work with a keyboard and a screen reader now, and the agency has a conformance report to share with counsel.
Taps on the dashboard respond without the freezes users complained about, and the budget stops new scripts from creeping back in without a review.
Partners serve themselves and manage their own users.
Prototype and design system components
what we do
Where we spend the hours
5 areas of work, each one done by an engineer who has run it in production.
We build portals that front CRM, billing and claims data, and the roles and permissions come from the identity provider, so access changes in one place.
Automated checks in CI, then manual keyboard and screen reader testing on the flows that matter. Automated tools catch only part of the problem, so we never rely on them alone.
Interaction to Next Paint replaced First Input Delay as a Core Web Vital in March 2024. We profile long tasks and heavy scripts against field data rather than a lab score alone.
Sign-in runs on OpenID Connect with Auth0, Okta or Entra ID, with passkeys and MFA where they fit and sessions handled on the server. We don't build custom password storage.
.NET 8 and .NET 9 leave support on 10 November 2026, and .NET 10 is the current long-term support release. We plan these upgrades with your release calendar.
capability 01 / 05in production
Customer and partner portals
We build portals that front CRM, billing and claims data, and the roles and permissions come from the identity provider, so access changes in one place.
Automated checks in CI, then manual keyboard and screen reader testing on the flows that matter. Automated tools catch only part of the problem, so we never rely on them alone.
Interaction to Next Paint replaced First Input Delay as a Core Web Vital in March 2024. We profile long tasks and heavy scripts against field data rather than a lab score alone.
Sign-in runs on OpenID Connect with Auth0, Okta or Entra ID, with passkeys and MFA where they fit and sessions handled on the server. We don't build custom password storage.
.NET 8 and .NET 9 leave support on 10 November 2026, and .NET 10 is the current long-term support release. We plan these upgrades with your release calendar.
We pieced these together from Web Development situations that come up a lot. They're patterns. You won't find a specific client in them.
case file 01
Benefits portal with custom widgets that trap keyboard focus
composite · not a client story
Beforethe situation
A public agency's benefits portal uses custom div-based dropdowns and modal dialogs that trap keyboard focus. An accessibility complaint cited the application form, and the agency serves more than 50,000 people, so its Title II date is 26 April 2027.
What we dothe work
Run axe in CI for a baseline, then test the application, renewal and document upload flows by hand with a keyboard, NVDA and VoiceOver. Replace custom widgets with native elements or working ARIA patterns, fix focus order and publish a conformance report against WCAG 2.2 AA.
Afterwhere you end up
The core flows work with a keyboard and a screen reader now, and the agency has a conformance report to share with counsel. Accessibility checks stay in CI, so a regression fails the build.
case file 02
Account dashboard that freezes on mid-range Android phones
composite · not a client story
Beforethe situation
Field data puts Interaction to Next Paint on the account dashboard well above the 200 ms threshold for a good score, mostly on mid-range Android phones. The page loads a large client bundle, three tag managers and a chat widget before the first tap responds.
What we dothe work
Pull the slow interactions out of CrUX or your real-user monitoring and profile them in Chrome DevTools to find the long tasks. Defer the third-party scripts, split the bundle by route and render the heavy parts on the server. Then add a performance budget to CI.
Afterwhere you end up
Taps on the dashboard respond without the freezes users complained about, and the budget stops new scripts from creeping back in without a review.
case file 03
Partners get pricing and order status by emailed spreadsheet
composite · not a client story
Beforethe situation
Partners get pricing and order status in spreadsheets attached to emails. Sales wants a portal on top of Salesforce data, where each partner sees only its own accounts and a partner admin can invite colleagues.
What we dothe work
Model partner organizations and roles in the identity platform, with delegated admin for partner managers. Build a backend-for-frontend that calls Salesforce with a scoped integration user and filters by partner on the server, checking ownership on every request.
Afterwhere you end up
Partners serve themselves and manage their own users. Access changes happen in one place, and no partner can read another partner's data by editing an ID in the URL.
The browser signs in through an identity platform over OpenID Connect, so the application never stores passwords. The portal backend calls CRM and ERP APIs with scoped tokens and reports real-user performance data.
01 · Browser
Customer or partnerdesktop · mobile browser → Web application · visit
02 · Sign-in
Identity platformAuth0 · Okta · Entra ID → Backend for frontend · ID and access token
MFA and passkeysWebAuthn → Identity platform · step-up
03 · Portal
Web applicationReact · Next.js · .NET → Identity platform · OIDC redirect→ Real-user monitoring · field metrics
Backend for frontendsession · token handling → CRM · scoped API call→ ERP · scoped API call
Real-user monitoringCore Web Vitals · INP
04 · Business systems
CRMSalesforce Experience data
ERPorders · invoices
Read the diagram as text
Customer or partner → Web application: visit
Web application → Identity platform: OIDC redirect
MFA and passkeys → Identity platform: step-up
Identity platform → Backend for frontend: ID and access token
Backend for frontend → CRM: scoped API call
Backend for frontend → ERP: scoped API call
Web application → Real-user monitoring: field metrics
how it runs
A typical engagement
We don't start a step until the last one has produced something you can check.
step 01
Discovery
Agree the users, critical journeys, integrations, accessibility obligations and performance targets before design starts.
step 02
Design and prototype
Put clickable prototypes in front of real users. Do at least one pass keyboard-only and one with a screen reader.
step 03
Build in increments
Short releases behind feature flags, each tested for accessibility, performance and security before it ships.
step 04
Launch and support
Watch real-user performance and errors. Then we keep maintaining it, or hand over with runbooks.
you keep
What you're left with
We write these for your Web Development setup, and they're working documents. Your team should be able to keep things running from them long after we've gone.
design01
Prototype and design system components
yours to keep
tests02
Application code with automated tests in CI
yours to keep
report03
Accessibility conformance report against WCAG 2.2 AA
Some clients want a project team, some want a couple of engineers on theirs. Either works. Onsite, nearshore or offshore, with handovers across time zones that keep things moving.
Onsite
Engineers at your sites in the US
Nearshore
Overlapping hours with US teams
Offshore
Overnight progress on your backlog
All time zones
Coverage handed over across time zones
24-hour coverage · US Central time
OnsiteUS business hours
Nearshoreoverlapping US hours
Offshoreovernight progress
Combinedhandover, not hand-off
00:0006:0012:0018:0000:00
roles we staff
Front-end developer (React, TypeScript)
Back-end developer (Node.js, .NET, Java)
Full-stack developer
Accessibility specialist
Web identity integration developer
QA automation engineer
due diligence · web development
Questions to ask any partner, including us.
Put these to anyone bidding on your Web Development work. The ones who've done it answer differently from the ones who've read about it.
Q1
Which flows will be tested by hand with a screen reader, and with which tools?
Automated tools only catch some WCAG failures. Ask the partner which flows, assistive technologies and browsers they test by hand, and make sure you get the results.
Q2
Will you measure performance from field data or only from Lighthouse?
Lab scores on a fast laptop miss what INP measures on real phones. CrUX or real-user monitoring shows the interactions customers actually wait on.
Q3
Where will session and access tokens live in the browser?
Tokens in localStorage are readable by any injected script. A backend-for-frontend with HTTP-only cookies keeps tokens off the page and limits what an XSS flaw can steal.
Q4
How will the server enforce access to each individual record?
Hiding a button doesn't stop someone calling the API with another customer's ID. Object-level checks on the server are the control that counts.
Q5
What is the framework and runtime upgrade plan after launch?
.NET 8 and .NET 9 leave support on 10 November 2026. Front-end frameworks and Node.js versions age just as quickly, and someone has to budget each upgrade.
01Which framework should we use?
It depends on your team and hosting. React-based frameworks suit content-heavy sites and portals with large front-end teams. Server-rendered .NET or Java fits teams with strong back-end skills. We pick what your engineers can maintain after we leave.
02How much does a web application cost?
The main drivers are the number of integrations, how many user roles and permission rules you have, accessibility and compliance needs, and data migration. Screens are rarely the expensive part.
03We're a public entity. When do we need to meet the ADA Title II web rule?
The Justice Department's April 2026 interim final rule moved the WCAG 2.1 AA compliance dates to 26 April 2027 for entities serving 50,000 people or more, and 26 April 2028 for smaller entities and special districts. Existing ADA obligations still apply in the meantime. Confirm the details with your counsel.
04Our application runs on .NET 8. How urgent is this?
Support ends on 10 November 2026, after which Microsoft stops shipping security fixes. The application keeps running, but each month on an unsupported runtime adds risk. Moving to .NET 10 LTS is usually a contained upgrade if dependencies are current.
05Can you rebuild the front end without replacing the backend?
Often, yes. If the APIs behind the site are sound, we rebuild the front end against them and leave the backend in place. We check API performance and authorization first, because a new front end on a leaky API keeps the leak.
related
Often paired with
Projects on Web Development usually end up touching one of these, so they're worth a look.
