1

I have a website on which users can select a file from their local machine, manipulate it and then save it.

The website is written entirely in JavaScript to ensure it's purely client-side. Is the content of the file that the user selects completely secure (from the perspective of the website itself, I realise the user could have malicious code on their local machine, etc.)?

Improve this question
5
  • 2
    What do you mean by "is the file secure"? Secure from what? What is the threat?
    – user163495
    Sep 19, 2019 at 9:13
  • Sorry, security is not my strong point. Secure in the general sense that a MITM (or similar) attack couldn't successfully get the data from the file the user uploaded on the client-side. Effectively I'm trying to figure out whether it's at all possible that the users' file data could be stolen through the website (ignoring any malicious code they may already have on their device)
    – Dell
    Sep 19, 2019 at 9:16
  • If the entire application runs on the client's browser, then there is no "upload" anywhere anyways.
    – user163495
    Sep 19, 2019 at 9:28
  • 1
    Is the website itself considered a potential threat (ie, what if you get hacked)?
    – AndrolGenhald
    Sep 19, 2019 at 9:31
  • No the website isn't to be considered a threat.
    – Dell
    Sep 19, 2019 at 9:36

1 Answer 1

Reset to default
1

Secure in the general sense that a MITM (or similar) attack couldn't successfully get the data from the file the user uploaded on the client-side

MitM is not possible in such a scenario as the file never leaves the client so the attacker cant intercept it. However, an attacker with Man-in-the-Middle capabilities could still intercept your JavaScript code in transmission, so it is highly recommended to use HTTPS everywhere.

The website is written entirely in JavaScript to ensure it's purely client-side

Well if there is no server side processing you have greatly reduced the attack surface.There is also no user base(cookies,jwt) i assume so an attacker cant target that either.The only thing i can think of is cross site scripting.An attacker could inject malicious javascript and then wait for the user to upload something,when the victim does he can simply retrieve that file.

Also i might add from androl's comment that you could also be "hacked" via vulnerability you introduce by using any piece of program that is vulnerable.But i wont comment on that.Always be updated and informed to prevent from such

Improve this answer
2
  • 1
    I added some more infos as to why HTTPS is useful. Feel free to roll back if you disagree with the addition.
    – user163495
    Sep 19, 2019 at 9:45
  • @MechMK1 no you are correct.I missed that point
    – yeah_well
    Sep 19, 2019 at 9:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .