Questions tagged [react]
React is a JavaScript library for building user interfaces.
30
questions
0
votes
1
answer
36
views
Running and unknown nodeJS/react app
I made a mistake - i was reached out for work regarding a project. Accidentally built it and ran it locally and it was obviously a bunch of nonsense code designed to look like a normal react project ...
- 101
0
votes
1
answer
393
views
Best practises regarding authentication in SPA/API solutions with SSO
There is really not that great information on what the best practices are for auth in SPA/API solutions. Most of them just say use JWTs and auth code flow in the SPA. There is a ton of information ...
- 113
0
votes
1
answer
242
views
React chars to HTML encode?
I've observed that React can HTML encode specific characters to prevent XSS vulnerabilities in certain contexts. For instance, consider the following code in App.jsx:
function App() {
const ...
- 11
2
votes
2
answers
792
views
Where or how to persist a decryption key in a React app?
I'm making a web application on the MERN stack which stores sensitive user data, in the form of a big block of text.
The encryption method I am using is that when a user registers, a random key is ...
- 21
0
votes
1
answer
199
views
Busines logic bypass issue
Good day, we deployed our app that has payment on it with a wallet system. We tried as much as possible to follow every security rule from server to code design. But yesterday we experienced a bridge ...
1
vote
2
answers
1k
views
Is my understanding of CSRF, SOP and CORS correct (Express / React)?
I am a hobby developer and am developing an application with a Node JS / Express backend and a React frontend.
I am currently learning about Cross Site Request Forgery (CSRF), and I want to make sure ...
- 11
1
vote
1
answer
2k
views
Using `react-oidc-context` and storing the `access_token` and `refresh_token` together
I am looking for a "best practises" approach for creating SPAs protected using OIDC + PKCE.
Most of our applications are hosted on two independent web servers with a load balancer routing ...
- 117
0
votes
0
answers
5k
views
Where to store token from auth header in React
I am currently working on a medium scale app and am a month into learning React. I got to the part where I need to authenticate users. I have written some code and It is working, but I don't know is ...
- 101
-1
votes
1
answer
136
views
how to fully secure web/mobile/desktop application connected the same backend server [closed]
I have a React/Express application, I want to fully secure it. I'm looking for best practices for these features:
data encryption/decryption
end-to-end communication
access control
role management
...
1
vote
1
answer
138
views
Can an attacker mess with a website that doesn't use a back-end server? (and how I can prevent that)
I'm developing a React web app where the user can input a .csv of their transaction data, and the app will output useful analysis that will inform their future purchase decisions.
I'm planning to use ...
- 11
0
votes
1
answer
1k
views
How do I properly secure my login using bcrypt in react and a python-flask backend?
I want to store the passwords of accounts hashed into a database that can be accessed through a python-flask application. When you would login, this python application is supposed to provide you with ...
- 3
1
vote
2
answers
249
views
How to protect client server app if both: client and server - located on client side?
Frontend communicates to backend.
I am a developer of frontend and backend.
I want to protect my app (prohibit end user from using my app without paying).
The only thing I have in mind is to have some ...
- 111
0
votes
2
answers
813
views
API key safety in front end app running in localhost
I have been working on a front end (React) app that sends REST requests to an API end point. I am aware that sensitive items such as API keys should not be stored in front end frameworks (like React, ...
- 145
3
votes
3
answers
2k
views
Securing client side code of react application [duplicate]
I'm developing application with react and all the main logic is on the client side. I want to force users to use the application only if they paid for the app subscription.
Are there any methods to ...
0
votes
2
answers
1k
views
How do I protect a Laravel backend API from hijacking/CSRF when there is a React frontend?
I'm finding it really hard to find a solution to make secure requests via our API without a potential hacker being able to see sensitive secret information via Google Chrome dev tools (or any browser'...
- 3
1
vote
0
answers
182
views
Can I read environment process variables of a react client in a browser?
I'm currently doing a pentest for a client and I've come across something new to me. When I log in, I view the username/password values in burpsuite and find they are encrypted using Cryptojs. I'm ...
- 23
1
vote
1
answer
1k
views
Ways to exploit a form action value when it s reflected from URI on React-Django
I am working on a security testing project, where I have noticed that the form action of a login page takes whatever is fed to URI as a parameter, the respective part of the login page is as follows:
...
- 11
2
votes
2
answers
228
views
Is there a security risk in hosting an app's HTML/JavaScript payment system on a CDN?
We have a mobile app (React and Expo) in which the user is able to provide payment via Stripe. Our implementation uses a WebView which renders HTML and JavaScript content, which in turn pulls in the ...
- 123
0
votes
1
answer
1k
views
Is sending token authentication information via cookie headers secure?
I am by no means a security engineer , and I have barely started my journey as a web developer. I'm utilizing a Python package known as Django for my backend and react.js for my front end. Recently I ...
- 101
0
votes
2
answers
230
views
Can GET Requests with Spring Rest controllers be intercepted by attackers?
I'm building a Spring app and a React app which also contains Chat functionality. I use WebSocket with RabbitMQ as message broker.
I store the chat history as encrypted messages with AES, and before ...
- 113
1
vote
1
answer
3k
views
React and NodeJS over TLS
I'm running a simple NodeJS REST API and a ReactJS frontend application and I want them to communicate in a secure way over TSL. I've successfully issued a certificate (DNS challenge) from Let's ...
- 11
8
votes
1
answer
5k
views
Generate CSRF token in SPA
I'm extremely confused on the topic of generating a session long CSRF token on a single page application using React.
It looks like the convention is to have the server generate the CSRF token on log ...
- 365
2
votes
1
answer
341
views
Double JWT submit method
I'm implementing my JWT method by using the double submit method: where we separate the payload & header portion of the JWT from the signature.
The header & payload is stored in a separate ...
- 365
4
votes
1
answer
3k
views
Protect public(?) API endpoints
I'm building a fairly simple web application at the moment but because I have plans on turning this into sort of a multi-project portfolio app, I've decided to decouple the back-end and the front-end. ...
- 43
3
votes
1
answer
724
views
Can an end-user modify conditional rendering in React?
On my Single Page App I am using MSAL.js to authenticate users and to also extract the groups they belong to by using Microsoft Graph endpoints. I save to a variable the Specific groups the user ...
- 133
3
votes
2
answers
469
views
Securing a Node.js REST API for React.js webapp as well as a standalone API
I'm trying to create a secure method of authentication for my Node.js REST API that will work both for direct API requests as well as from my React.js web application. I've done some reading on how to ...
- 31
0
votes
1
answer
258
views
Application design to avoid XSS & CSRF attacks
I am learning to design a system where it can be guarded against XSS & CSRF attack. I'll quickly list down my understanding and then raise questions. It's a simple case of fraud that I am trying ...
0
votes
1
answer
327
views
what is the best algorithm for hashing stored users info on client-side on a web app
I have this scenario in a web app which I'm working on its client-side code(I'm building it with ReactJS):
I obtain user's info
hash 'em
send it to the server for being authenticated
and when I get ...
- 103
3
votes
1
answer
4k
views
Am I safe from XSS in React as long as I don't use dangerouslySetInnerHTML?
Let's say I write a webapp using React only, never touching the DOM directly. I never use dangerouslySetInnerHTML. Do I still have to worry about XSS? Or in other words, are there any other unsafe ...
- 65.7k
2
votes
1
answer
389
views
How is the create-react-app package tree properly sanitized?
React, and it's application creation script, create-react-app, are popular packages nowadays... and with good reason: React is a rock-star framework.
From a security perspective, sanitizing all the ...
- 129