2

I designed a small webapp (I would rather call it browserApp) that helps me to automate a task. Now, I don't need a webserver to host this app as it is merely using js, jquery and other js libraries to run it in my browser which is good enough for me, plus, does not make use of databases or another tier like an apache web server and makes no use of backend code. I added some security features like sanitation of character, etc, that will only protect from crashing (there is not data saved after the process is done, so there is no db to reach, everything in client-side of course).

I'm trying to understand the security considerations of having this small tool running from time to time on my browser. It seems harmless but in my experience "seeming" leads to the opposite in reality.

2
  • So, you are just opening a local file that launches in a browser?
    – schroeder
    Nov 12 '19 at 21:55
  • Yes bro. Pure side client, local file, no external references. Nov 17 '19 at 5:30
2

If you are simply opening an HTML file, that you wrote, in a standard-issue web browser, then things will be safe.

This is assuming that your application is making no HTTP requests outwards.

Here's why

1) Browser are well sandboxed. Unless you've written code that specifically requests permissions to interact with software outside of your browser (and you, as a user, grant these permissions, then the impact that your code can do is limited. 2) Since you'll be accessing your 'app' via the file:// protocol, any cross-domain attacks are going to fail. 3) Since you're not accessing your 'app' via the https:// protocol, a lot of functionality will be locked down by the browser anyway (for instance, you'll have no access to WebRTC).

So, if you're app isn't pulling data in from any sources and doesn't have the ability to send data out to any sinks, then you're in good shape.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.