Questions tagged [react]

React is a JavaScript library for building user interfaces.

Filter by
Sorted by
Tagged with
0 votes
0 answers
63 views

Where to store token from auth header in React

I am currently working on a medium scale app and am a month into learning React. I got to the part where I need to authenticate users. I have written some code and It is working, but I don't know is ...
user avatar
-1 votes
1 answer
28 views

how to fully secure web/mobile/desktop application connected the same backend server [closed]

I have a React/Express application, I want to fully secure it. I'm looking for best practices for these features: data encryption/decryption end-to-end communication access control role management ...
user avatar
0 votes
0 answers
24 views

Security Practices for a React App - Node.js - Notion REST API Pipeline

I've been thinking about security practices for a personal project where I would create content on a Notion account and have a Node.js middleware server that'll act as a REST API that allows anybody ...
user avatar
1 vote
1 answer
83 views

Can an attacker mess with a website that doesn't use a back-end server? (and how I can prevent that)

I'm developing a React web app where the user can input a .csv of their transaction data, and the app will output useful analysis that will inform their future purchase decisions. I'm planning to use ...
user avatar
  • 11
0 votes
1 answer
232 views

How do I properly secure my login using bcrypt in react and a python-flask backend?

I want to store the passwords of accounts hashed into a database that can be accessed through a python-flask application. When you would login, this python application is supposed to provide you with ...
user avatar
0 votes
0 answers
84 views

react.js security from a novice - front-end development security

I am developing a dApp for my dissertation at University. As I do not come from a computer science background, I am unsure of security risks, specifically related to the javascript front-end of my ...
user avatar
0 votes
0 answers
86 views

How to restrict pages on React.js using JWT?

I'm using React.js (with react-router for serving content) for frontend with a golang backend. For the authentication I'm using JWT. But I've now stumbled upon a problem. How do I keep users from ...
user avatar
  • 35
1 vote
2 answers
169 views

How to protect client server app if both: client and server - located on client side?

Frontend communicates to backend. I am a developer of frontend and backend. I want to protect my app (prohibit end user from using my app without paying). The only thing I have in mind is to have some ...
user avatar
0 votes
2 answers
194 views

API key safety in front end app running in localhost

I have been working on a front end (React) app that sends REST requests to an API end point. I am aware that sensitive items such as API keys should not be stored in front end frameworks (like React, ...
user avatar
  • 145
3 votes
3 answers
1k views

Securing client side code of react application [duplicate]

I'm developing application with react and all the main logic is on the client side. I want to force users to use the application only if they paid for the app subscription. Are there any methods to ...
user avatar
0 votes
2 answers
366 views

How do I protect a Laravel backend API from hijacking/CSRF when there is a React frontend?

I'm finding it really hard to find a solution to make secure requests via our API without a potential hacker being able to see sensitive secret information via Google Chrome dev tools (or any browser'...
user avatar
  • 3
1 vote
0 answers
84 views

Can I read environment process variables of a react client in a browser?

I'm currently doing a pentest for a client and I've come across something new to me. When I log in, I view the username/password values in burpsuite and find they are encrypted using Cryptojs. I'm ...
user avatar
  • 23
1 vote
1 answer
385 views

Ways to exploit a form action value when it s reflected from URI on React-Django

I am working on a security testing project, where I have noticed that the form action of a login page takes whatever is fed to URI as a parameter, the respective part of the login page is as follows: ...
user avatar
  • 11
2 votes
2 answers
164 views

Is there a security risk in hosting an app's HTML/JavaScript payment system on a CDN?

We have a mobile app (React and Expo) in which the user is able to provide payment via Stripe. Our implementation uses a WebView which renders HTML and JavaScript content, which in turn pulls in the ...
user avatar
  • 123
0 votes
1 answer
530 views

Is sending token authentication information via cookie headers secure?

I am by no means a security engineer , and I have barely started my journey as a web developer. I'm utilizing a Python package known as Django for my backend and react.js for my front end. Recently I ...
user avatar
0 votes
2 answers
139 views

Can GET Requests with Spring Rest controllers be intercepted by attackers?

I'm building a Spring app and a React app which also contains Chat functionality. I use WebSocket with RabbitMQ as message broker. I store the chat history as encrypted messages with AES, and before ...
user avatar
  • 101
1 vote
1 answer
1k views

React and NodeJS over TLS

I'm running a simple NodeJS REST API and a ReactJS frontend application and I want them to communicate in a secure way over TSL. I've successfully issued a certificate (DNS challenge) from Let's ...
user avatar
  • 11
7 votes
1 answer
4k views

Generate CSRF token in SPA

I'm extremely confused on the topic of generating a session long CSRF token on a single page application using React. It looks like the convention is to have the server generate the CSRF token on log ...
user avatar
  • 335
2 votes
1 answer
206 views

Double JWT submit method

I'm implementing my JWT method by using the double submit method: where we separate the payload & header portion of the JWT from the signature. The header & payload is stored in a separate ...
user avatar
  • 335
3 votes
1 answer
2k views

Protect public(?) API endpoints

I'm building a fairly simple web application at the moment but because I have plans on turning this into sort of a multi-project portfolio app, I've decided to decouple the back-end and the front-end. ...
user avatar
  • 33
3 votes
1 answer
608 views

Can an end-user modify conditional rendering in React?

On my Single Page App I am using MSAL.js to authenticate users and to also extract the groups they belong to by using Microsoft Graph endpoints. I save to a variable the Specific groups the user ...
user avatar
  • 133
2 votes
1 answer
372 views

Securing a Node.js REST API for React.js webapp as well as a standalone API

I'm trying to create a secure method of authentication for my Node.js REST API that will work both for direct API requests as well as from my React.js web application. I've done some reading on how to ...
user avatar
  • 21
0 votes
1 answer
221 views

Application design to avoid XSS & CSRF attacks

I am learning to design a system where it can be guarded against XSS & CSRF attack. I'll quickly list down my understanding and then raise questions. It's a simple case of fraud that I am trying ...
user avatar
0 votes
1 answer
164 views

what is the best algorithm for hashing stored users info on client-side on a web app

I have this scenario in a web app which I'm working on its client-side code(I'm building it with ReactJS): I obtain user's info hash 'em send it to the server for being authenticated and when I get ...
user avatar
3 votes
1 answer
3k views

Am I safe from XSS in React as long as I don't use dangerouslySetInnerHTML?

Let's say I write a webapp using React only, never touching the DOM directly. I never use dangerouslySetInnerHTML. Do I still have to worry about XSS? Or in other words, are there any other unsafe ...
user avatar
  • 64.2k
2 votes
1 answer
355 views

How is the create-react-app package tree properly sanitized?

React, and it's application creation script, create-react-app, are popular packages nowadays... and with good reason: React is a rock-star framework. From a security perspective, sanitizing all the ...
user avatar
  • 129