I'm looking into Single Page Applications that are used for both mobile development (PhoneGap) and regular websites.
Since the application can load from a offline copy, can run from http://localhost
, or can be packaged as an app visible in the Apple App Store or Android Play Store (etc), the standard approach of setting credentials for the user and accessing resources is different.
Namely, Microsoft has a whole infrastructure that enables OAuth for native applications (though I don't see if/how they address SPA applications).
Question
Are SPA applications more or less immune to CSRF, XSS, or other normal attacks?
What about SPA applications embedded in PhoneGap, or some other app?
Since SPA applications can read the REST data in the URLs passed to it, what protections are there from phone or normal web apps that respond this way?
Are there misconceptions about how to do SPA applications that lead to security vulnerabilities? (I've often seen app developers ask how to use Javascript "encryption" instead of HTTPS here)
Are authentication concerns different? (HTML5 Session usage vs passing parameters to the second SPA page)
I haven't seen much discussed about this new way of developing an application in light of security, and suspect that there are many security missteps here.