I have a single-page javascript application that communicates with a .NET API running in IIS. Authentication is done after loading the application frontend, using an OAuth token from Office 365, obtained using ADAL.js and verified by WindowsAzureActiveDirectoryBearerAuthentication middleware from Microsoft OWIN library, just like this sample app.

Yesterday, someone told me that this behaviour (having a JS application openly available in the internet with only the API secured) is not conforming to ISO 27001, and that the source code of the frontend should only be available to an attacker once he has successfully logged in with a verified account. Since I never heard of ISO 27001 before, and I have no access to that standard either, maybe someone can tell me whether this is correct or not, and what the current state of the art would be.

  • 2
    Ask that someone to point out WHERE the standard suggests something like that. Even if something in the 27000 family stays anything about implementation: source code must be irrelevant. To access source code for front-end web app is simply unavoidable (but again, it does not matter, assuming everything is well implemented) – Adriano Repetti Jul 14 '18 at 8:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.