0

I am developing a simple grammar study website with Bootstrap 5, JQuery and Javascript. It will have interactive grammar quizzes and flashcards. I would like users to be able to type in answers to grammar questions and upload their own vocabulary sets via CSV files. There will be no logins, no back-end and no data persistence: everything will run in the browser. No uploaded data will survive a refresh. I would like to ultimately host it as a static site with a cloud PaaS provider.

I figure server hardening (HTTPS, DDoS, headers, etc...) will be handled by the cloud host. I want to follow every security best practice and button-up every potential hole in the code, though. What are the actual risks with a semi-static site like this, particularly regarding user input?

Thank you!

6
  • If there's no "backend", where are they uploading the csv file too?
    – Blake
    Jul 26 at 18:30
  • 1
    Good question! The data from the file just gets read into a variable in the Javascript. Technically, it's not really uploading the file I suppose as much as reading the data from a file on the source computer into the browser. Jul 26 at 18:56
  • 1
    WRT, 'There will be no logins, no back-end and no data persistence: everything will run in the browser. No uploaded data will survive a refresh.' - is this a single page application (SPA)? If so, does the SPA interact with a server through XHR (or AJAX) calls?
    – mti2935
    Jul 26 at 18:57
  • Hello! Yes, I believe this could be considered an SPA. Initial request will pull down the HTML, CSS and JS. Then, interactions from the user (answering questions) will rewrite parts of the page (i.e. show the correct answer, build new question) via Javascript. There will be no calls back to the server involved: the logic is all in the script. The user could, optionally, load a CSV file ("word1","definition1") from their computer to replace the default 'questions' variable in the code with custom vocab. Input is escaped and reloading the page will wipe that out, of course. Jul 26 at 19:30
  • 1
    Thank you: I appreciate your help! Jul 26 at 22:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.