Start here: SPFx developer

For developers who build SharePoint Framework web parts and extensions and ship them to the app catalog and Teams. After this path you can call SharePoint REST correctly, package and deploy without surprises, debug runtime errors and render list content safely.

1. Calling SharePoint REST like a proThe client landscape, headers that matter, safe writes and a ten minute diagnosis routine; the base for everything that follows.The client landscape, headers that matter, safe writes, reading well, field/list creation quirks, and a ten-minute diagnosis routine
2. Three .sppkg packaging pitfalls — diacritics, icon size, the Publisher columnASCII solution name, an exact 96x96 icon, and why the Publisher column stays empty; three upload time traps in one place.ASCII-only solution name, icon exactly 96×96, Publisher column is AppSource-only
3. A CDN-hosted SPFx bundle still needs a new .sppkgHosting assets on a CDN does not free you from versioning; the manifest pins a hashed file name, so old packages never update.includeClientSideAssets: false moves assets, not versioning; the manifest pins a content-hashed filename, so old packages never request the new bundle
4. SPFx in Teams — a personal app needs global deployment, not a root-site installA Teams personal app needs skipFeatureDeployment plus deploy to all sites, and the teams icon folder convention to show up at all.skipFeatureDeployment: true + "all sites"; the teams/ icon-folder convention
5. A Graph scope your SPFx solution never asked for may already work — grants are tenant-widewebApiPermissionRequests is only a request and grants land on one shared principal; explains why a scope works here but not at a customer.webApiPermissionRequests is a request, not a grant; an approval lands on one tenant-wide principal, so a scope another solution had approved already works in yours (and may be missing at the customer)
6. Drop __metadata from write bodies — odata=verbose needs OData v3, and SPHttpClient sends v4Old tutorial payloads with __metadata fail under SPHttpClient; write plain JSON and save yourself a round of puzzling 400s.Old-tutorial payloads 400 as plain JSON, and switching to odata=verbose 400s again under SPHttpClient, which sends odata-version: 4.0; write plain JSON without the type hint, or blank odata-version where the verbose…
7. Get lists by URL, not by titlegetbytitle breaks as soon as someone renames a list; resolving by URL is the habit that keeps deployed web parts working.getbytitle() breaks the moment someone renames a list; resolve by URL (bonus: GetList normalises folder paths to their list)
8. Minified React error #310 (and friends) — the SPFx debugging cheatsheetDecodes the minified React errors you see in production bundles, so a blank web part points to a cause instead of a guess.#310/#300/#321/#31/#185 decoded for SPFx debugging
9. SharePoint's SPA router hijacks anchor clicks — onClick never firesAn a href navigates before your onClick runs on a published modern page; use buttons for in-app actions so clicks stop navigating away.navigates before React onClick runs; use buttons for in-app actions
10. Stored XSS via SharePoint list content — React won't save youReact does not block javascript: links taken from list items; an allowlist helper at every link sink closes that stored XSS hole.React doesn't block javascript: hrefs; allowlist safeHref with C0-strip at every sink

← all reading paths and Top 10 lists