Questions tagged [react]

React is a JavaScript library for building user interfaces.

Filter by
Sorted by
Tagged with
0 votes
0 answers
18 views

Is it possible to disallow external IPs from accessing a page of a React site? [migrated]

I'm currently learning React to host a personal website (on an Ubuntu server) and am port forwarding it to allow access from the internet. However, for security reasons, I'd like one or more pages to ...
Omaro_IB's user avatar
  • 101
2 votes
2 answers
284 views

Where or how to persist a decryption key in a React app?

I'm making a web application on the MERN stack which stores sensitive user data, in the form of a big block of text. The encryption method I am using is that when a user registers, a random key is ...
lostCoder's user avatar
0 votes
0 answers
65 views

Redirect security with opaque state token to SPA on login

I am currently working on a sign-up flow on Auth0 where I need to get GDPR consent after a person does a social login. We can run serverless functions using their Actions that check if GDPR has been ...
physicsmajor1's user avatar
0 votes
1 answer
110 views

Busines logic bypass issue

Good day, we deployed our app that has payment on it with a wallet system. We tried as much as possible to follow every security rule from server to code design. But yesterday we experienced a bridge ...
Kingsley Osuji's user avatar
1 vote
2 answers
638 views

Is my understanding of CSRF, SOP and CORS correct (Express / React)?

I am a hobby developer and am developing an application with a Node JS / Express backend and a React frontend. I am currently learning about Cross Site Request Forgery (CSRF), and I want to make sure ...
David's user avatar
  • 11
0 votes
0 answers
1k views

Using `react-oidc-context` and storing the `access_token` and `refresh_token` together

I am looking for a "best practises" approach for creating SPAs protected using OIDC + PKCE. Most of our applications are hosted on two independent web servers with a load balancer routing ...
user1913559's user avatar
0 votes
0 answers
4k views

Where to store token from auth header in React

I am currently working on a medium scale app and am a month into learning React. I got to the part where I need to authenticate users. I have written some code and It is working, but I don't know is ...
NoDiggityNoDoubt's user avatar
-1 votes
1 answer
73 views

how to fully secure web/mobile/desktop application connected the same backend server [closed]

I have a React/Express application, I want to fully secure it. I'm looking for best practices for these features: data encryption/decryption end-to-end communication access control role management ...
Ayoub Benayache's user avatar
1 vote
1 answer
101 views

Can an attacker mess with a website that doesn't use a back-end server? (and how I can prevent that)

I'm developing a React web app where the user can input a .csv of their transaction data, and the app will output useful analysis that will inform their future purchase decisions. I'm planning to use ...
Khang's user avatar
  • 11
0 votes
1 answer
904 views

How do I properly secure my login using bcrypt in react and a python-flask backend?

I want to store the passwords of accounts hashed into a database that can be accessed through a python-flask application. When you would login, this python application is supposed to provide you with ...
DrRonne's user avatar
1 vote
2 answers
203 views

How to protect client server app if both: client and server - located on client side?

Frontend communicates to backend. I am a developer of frontend and backend. I want to protect my app (prohibit end user from using my app without paying). The only thing I have in mind is to have some ...
John Smith's user avatar
0 votes
2 answers
577 views

API key safety in front end app running in localhost

I have been working on a front end (React) app that sends REST requests to an API end point. I am aware that sensitive items such as API keys should not be stored in front end frameworks (like React, ...
u9kV-6J's user avatar
  • 145
3 votes
3 answers
2k views

Securing client side code of react application [duplicate]

I'm developing application with react and all the main logic is on the client side. I want to force users to use the application only if they paid for the app subscription. Are there any methods to ...
mikereverichi's user avatar
0 votes
2 answers
769 views

How do I protect a Laravel backend API from hijacking/CSRF when there is a React frontend?

I'm finding it really hard to find a solution to make secure requests via our API without a potential hacker being able to see sensitive secret information via Google Chrome dev tools (or any browser'...
Bilal's user avatar
  • 3
1 vote
0 answers
136 views

Can I read environment process variables of a react client in a browser?

I'm currently doing a pentest for a client and I've come across something new to me. When I log in, I view the username/password values in burpsuite and find they are encrypted using Cryptojs. I'm ...
Crashie's user avatar
  • 23
1 vote
1 answer
1k views

Ways to exploit a form action value when it s reflected from URI on React-Django

I am working on a security testing project, where I have noticed that the form action of a login page takes whatever is fed to URI as a parameter, the respective part of the login page is as follows: ...
GunG's user avatar
  • 11
2 votes
2 answers
187 views

Is there a security risk in hosting an app's HTML/JavaScript payment system on a CDN?

We have a mobile app (React and Expo) in which the user is able to provide payment via Stripe. Our implementation uses a WebView which renders HTML and JavaScript content, which in turn pulls in the ...
jlmt's user avatar
  • 123
0 votes
1 answer
933 views

Is sending token authentication information via cookie headers secure?

I am by no means a security engineer , and I have barely started my journey as a web developer. I'm utilizing a Python package known as Django for my backend and react.js for my front end. Recently I ...
neowenshun's user avatar
0 votes
2 answers
186 views

Can GET Requests with Spring Rest controllers be intercepted by attackers?

I'm building a Spring app and a React app which also contains Chat functionality. I use WebSocket with RabbitMQ as message broker. I store the chat history as encrypted messages with AES, and before ...
ryansan's user avatar
  • 101
1 vote
1 answer
2k views

React and NodeJS over TLS

I'm running a simple NodeJS REST API and a ReactJS frontend application and I want them to communicate in a secure way over TSL. I've successfully issued a certificate (DNS challenge) from Let's ...
Pascal's user avatar
  • 11
7 votes
1 answer
5k views

Generate CSRF token in SPA

I'm extremely confused on the topic of generating a session long CSRF token on a single page application using React. It looks like the convention is to have the server generate the CSRF token on log ...
alex067's user avatar
  • 355
2 votes
1 answer
298 views

Double JWT submit method

I'm implementing my JWT method by using the double submit method: where we separate the payload & header portion of the JWT from the signature. The header & payload is stored in a separate ...
alex067's user avatar
  • 355
4 votes
1 answer
3k views

Protect public(?) API endpoints

I'm building a fairly simple web application at the moment but because I have plans on turning this into sort of a multi-project portfolio app, I've decided to decouple the back-end and the front-end. ...
Ecaz's user avatar
  • 43
3 votes
1 answer
686 views

Can an end-user modify conditional rendering in React?

On my Single Page App I am using MSAL.js to authenticate users and to also extract the groups they belong to by using Microsoft Graph endpoints. I save to a variable the Specific groups the user ...
user5950's user avatar
  • 133
3 votes
1 answer
417 views

Securing a Node.js REST API for React.js webapp as well as a standalone API

I'm trying to create a secure method of authentication for my Node.js REST API that will work both for direct API requests as well as from my React.js web application. I've done some reading on how to ...
vipulp's user avatar
  • 31
0 votes
1 answer
233 views

Application design to avoid XSS & CSRF attacks

I am learning to design a system where it can be guarded against XSS & CSRF attack. I'll quickly list down my understanding and then raise questions. It's a simple case of fraud that I am trying ...
Always a newComer's user avatar
0 votes
1 answer
279 views

what is the best algorithm for hashing stored users info on client-side on a web app

I have this scenario in a web app which I'm working on its client-side code(I'm building it with ReactJS): I obtain user's info hash 'em send it to the server for being authenticated and when I get ...
BlackSheep's user avatar
3 votes
1 answer
3k views

Am I safe from XSS in React as long as I don't use dangerouslySetInnerHTML?

Let's say I write a webapp using React only, never touching the DOM directly. I never use dangerouslySetInnerHTML. Do I still have to worry about XSS? Or in other words, are there any other unsafe ...
Anders's user avatar
  • 65.4k
2 votes
1 answer
366 views

How is the create-react-app package tree properly sanitized?

React, and it's application creation script, create-react-app, are popular packages nowadays... and with good reason: React is a rock-star framework. From a security perspective, sanitizing all the ...
kmiklas's user avatar
  • 129