The tag has no wiki summary.

learn more… | top users | synonyms

0
votes
2answers
94 views

How to ensure that only my single page app can make requests to an API

I have a REST API that can potentially serve multiple web clients. I want to ensure that only my single page app on my-one-and-only-web-cleint.com can make requests to my API. How do I do this? ...
0
votes
1answer
189 views

Security with Single Page application

I am creating SPA application using Angular. This will serve my two purpose for middle layer on mobile as well website. Now trying to security my application from XSS, CSRF and also wanted secure ...
2
votes
1answer
81 views

Does using token-based auth make CSRF checks on login unnecessary?

Based on my understanding, avoiding the use of cookies as an authentication mechanism prevents CSRF vulnerabilities entirely (namely token based authentication in an SPA), when authenticated. Does ...
5
votes
3answers
141 views

Secure a publicly accessible REST api

We're building a public single page app in JavaScript that talks to a back-end REST service. What we want is for that REST-service to be only accessible from the single page app. Since it's a public ...
1
vote
1answer
63 views

Securing single page application [closed]

I developed a web application in single-page application (SPA) architecture using Ext JS as client interface, but I have a trouble defining the right way of securing it with AJAX queries. How could I ...
2
votes
2answers
104 views

Securing internal REST service call via JavaScipt

I have a public Single Page Application (SPA) that is calling my backend REST service via JavaScript. How can I secure the REST service so that it will only accept calls from my SPA and no other ...
0
votes
2answers
466 views

E-Commerce website with REST backend : do I have to secure Backend URLs accessed by Front end public pages?

I have an e-commerce website with a REST backend and a Single page JS as front end. I intend to secure my REST backend with OAuth2. I don't want to oblige the user to authenticate when he first comes ...
2
votes
2answers
223 views

Do SPA applications have different security considerations than HTML5 sites?

I'm looking into Single Page Applications that are used for both mobile development (PhoneGap) and regular websites. Since the application can load from a offline copy, can run from ...
6
votes
2answers
3k views

CSRF protection and Single Page Apps

I am in the process of writing a thick client web app using Angular.js (single page app) and was wondering what are the best practices for securing the app using a CSRF token. Should I send a CSRF ...