Questions tagged [single-page-app]

A single page app (SPA) is a web application using only one HTML page. JavaScript is commonly used to modify the single page, and AJAX to fetch data from the server.

Filter by
Sorted by
Tagged with
1
vote
0answers
40 views

Oauth2.0 | How to manage user session in Single Page application running in an iframe?

I'm new to security domain, and recently I have learned about Oauth2.0/OpenID connect and JWT tokens. I have an existing REST based web application where I need to implement security. Server ...
1
vote
3answers
85 views

Content Security Policy applied to Single Page Applications: Is it worth it with unsafe-inline?

I have a website developed using VueJS (i.e. its a single page application). I've been looking at implementing Content Security Policy headers. As I tested out the header values I would need, I ...
1
vote
1answer
63 views

Why *is* PKCE recommended for single page JavaScript apps?

This question is essentially the opposite of Why isn't PKCE encouraged for Single-Page Apps?. In recent years, most OAuth API vendors seem to be have become unanimous in recommending that ...
0
votes
0answers
39 views

Taking advantage of subdomains for refresh token rotation in SPAs

Say I have three components in a system: An identity service, hosted at identity.mydomain.com A single page application, served from app.mydomain.com An API, protected by requiring a bearer token ...
0
votes
1answer
48 views

Is there a current best practice for authorizing an SPA to get/post to API

I have an API and an SPA. The SPA is all anonymous but I want to ensure the caller of the API is authorized to do so. It seems that all of the OAuth best practices, e.g. PKCE, depend on a user ...
2
votes
2answers
73 views

Using OAuth SPA app to provide third party with access token

Say I had a centralized OAuth 2 authentication server, a Single Page Application (SPA) in an electron app, and a third-party server. The user launches this SPA, goes through the PKCE flow to obtain an ...
0
votes
1answer
54 views

Difference between Form Post Response and Authorization Code

I am trying to find the best OAuth2 mechanism for our VueJS Single Page Application (SPA) hosted on our own backend. From my research, Authorization Code should be sufficient, as long as the redirect ...
0
votes
1answer
63 views

Using a persistent httpOnly cookie for authentication? (SPA)

So I'm building an application that needs authentication, I'm wondering if there's an security concerns with using a persistent httpOnly cookie to store user authentication with a SPA? (only 1 server. ...
2
votes
1answer
260 views

Auth code grant /w PKCE for SPAs

I'm a security newb trying to find out how to secure my SPAs, and am totally lost in the forest of RFCs, BCPs, drafts and blog posts. If possible, I'd like to serve my SPAs statically from a cdn. At ...
2
votes
0answers
59 views

Are the trade offs for putting an auth token in an http-only cookie for an SPA worth it?

I've been building a web app (rails api + react SPA) for learning / fun and have been researching authentication. The most commonly recommended approach for authenticating SPAs that I have read is to ...
1
vote
0answers
79 views

SAML Passing a JWT token from the API to the SPA application

We are trying to implement the SAML 2.0 protocol and I stumbled upon a problem related to passing the token from the API to the client SPA application. The authentication flow goes like this: the ...
3
votes
1answer
497 views

Can an end-user modify conditional rendering in React?

On my Single Page App I am using MSAL.js to authenticate users and to also extract the groups they belong to by using Microsoft Graph endpoints. I save to a variable the Specific groups the user ...
0
votes
0answers
43 views

Is it useful to have separate access tokens and refresh tokens if they're going to be stored on the client-side as cookie?

(This is a followup to my question about a general security scheme here) As part of an authentication scheme for a single-page application + REST API, I planned to provide authenticated clients with ...
4
votes
2answers
159 views

Is this security scheme using passwords, short-lived access JWTs, and long-lived refresh tokens a good way to secure a REST API?

I'm trying to secure a REST API that I'm using as a backend for a single-page application. The API provides access to read/create/modify/delete protected resources, based on a set of permissions ...
0
votes
1answer
52 views

What was the point of Implicit Grant Flow in OAuth 2.0?

I've read a lot about Implicit Grant Flow and when it should be used, but I can't wrap my head around a use case for where it would have made sense over the Authentication Code Grant Flow before PKCEs ...
2
votes
0answers
42 views

CSP for iFrame without any src attribute

I am looking for recommendations on how to implement our CSP policy. We have an Angular SPA application, that has an iframe without any src attribute. We populate the content of the iframe dynamically ...
-1
votes
1answer
68 views

Fundamentals of securing a web app? [closed]

I am trying to build an app that deals with finance, specifically crypto-currency. What are the fundamentals (preferably in point form, but I'd appreciate explanations too) of securing such an app ...
0
votes
3answers
59 views

Is there a way to protect against fake messages by an SPA that consumes a webservice directly?

I develop a webservice currently and communication might be a bottleneck. It would be at least 100ms faster if I could access the webservice from the browser directly instead of sending the messages ...
1
vote
1answer
77 views

Which grant type : Implicit or Auth code (with No secret key) is suitable for Single Page Application(SPA)?

I went thru multiple posts saying how implicit grant is a security risk and why auth code grant with AJAX request to Authorization server should be used after redirecting to application (without ...
3
votes
1answer
331 views

Storage of API authentication token in single-page-applications

I'm building a JSON API. For authentication I plan to use a random-token based approach, with the random token having 256 bits of entropy and generated using a CSRNG. A hash of the token will be ...
1
vote
2answers
259 views

OIDC SPA Keycloak refresh_token storage location

I have Single Page Application based on Open ID Connect flow (keycloak). I wonder what are the security considerations for refresh token storage - what are the advantages and disadvantages for ...
3
votes
4answers
555 views

Is it possible to truly hide content behind a paywall in a single page app?

I would like to hide certain content behind a paywall in my VueJS app. In googling around... Some tutorials recommend storing the currently logged in user in local storage. And then before showing ...
1
vote
0answers
54 views

Is the OAuth implicit flow too insecure for serverless single page web applications?

Assuming the need for OAuth Imagine an application that is: A single page web application hosted on S3 Authenticated using implicit OAuth flow implicit Have the web application access resources ...
1
vote
0answers
361 views

CSRF protection and Single Page Apps on hosted on S3 (with no backend.)

I have a webapp written in js that runs on AWS S3. There is no way to initialize a secure CSRF token on page load since there is no backend server. The token has to be retrieved via an AJAX call to my ...
0
votes
1answer
890 views

XSS prevention in single page web applications

One of my colleagues suggested the following methods to secure against XSS attacks in my angular5 application: Enable X-XSS-Protection header Enable X-frame-options header Adding proper content ...
1
vote
0answers
135 views

Restrict Public API To Access From Single App

I have a REST api on a server and an application for android phones that mostly makes calls to that api and presents the info to the user. Because the application needs to be a quick way to lookup ...
0
votes
1answer
72 views

Non-standard OIDC flow: How safe is this?

I have been made aware of an application, at a client, that claims to use OIDC to authenticate users. This is however done via a non-standard flow that I find hard to assess from a security standpoint....
2
votes
1answer
1k views

Implicit flow login from SPA

Looking at the implicit flow to login with https://github.com/IdentityModel/oidc-client-js and https://github.com/IdentityServer/IdentityServer4.Samples/tree/release/Quickstarts/7_JavaScriptClient . ...
4
votes
0answers
381 views

Concepts to support local and external authentication: JWT, Cookies, HttpOnly, …?

I am trying to figure out the correct authentication strategy and concepts for a single page web application (SPA) featuring local login as well as 3rd party login (e.g. Google, Auth0). Unfortunately, ...
2
votes
0answers
1k views

Protecting frontend code for SPA + Restful API with OIDC

I've got an Angular 1 SPA with a Restful API that I'd like to restrict access to. As I understand, typically the OIDC Implicit flow is designed just for this. However, I consider the frontend SPA code ...
5
votes
2answers
2k views

Is CSRF possible in an SSR SPA with cookie authentication?

I have a Single-Page Application, which is basically a consumer to my API which authenticates using the Authorization header. Now because I do server-side-rendering, I need to authenticate on the ...
1
vote
2answers
2k views

Is a single page application naturally breaking the same-origin policy?

Assume that you have a web application. The backend API is deployed at api.example.com and your frontend SPA is deployed at frontend.example.com. When you open it you download all the resources to ...
2
votes
1answer
107 views

Evaluating spam score for a single page application

I am developing a single page application with a behaviour similar to google Maps and I want to avoid spam as much as possible. Users can register on my website to get access to an API KEY. Then, on ...
4
votes
0answers
358 views

Security Implications of a Single Page E-Commerce Application [closed]

I'm asking here because there seem to be zero resources online about this kind of thing. I've built an single page e-commerce website that uses Stripe, Laravel, VueJS, Vue Router and Vuex. Everything ...
1
vote
1answer
633 views

Is a SPA vulnerable to the BREACH https security exploit?

I have a Single Page Application (SPA) that consists of static resources (HTML, JS, CSS, images fonts ...) that are served from an Apache web server and several API endpoints (serving JSON from a ...
1
vote
2answers
58 views

How to properly handle unathorized errors in SPAs [closed]

In order to prevent URL guessing for unauthorized users I will return a 404 error even if the URL exists. It's better to always return a 404 error page even if the call is to an API?? or is better to ...
1
vote
2answers
1k views

High security application in Angular - a bad idea?

Well this is not a question of a specific problem I have it's more a general question. Yesterday I had a little argument with a friend of mine wehter or not a "high security application" (e-Banking ...
0
votes
3answers
5k views

Encrypting the API response in a single page app

I am building a single-page(React-Redux on FE, Rails-API BE) application which makes a bunch of REST API calls to get certain information for logged-in users. Some subset of that information (...
1
vote
1answer
349 views

Inject custom markup via vanilla JS without increasing risk of client-side XSS? [duplicate]

The world of business-to-business enterprise software has always required a high level of custom per-client markup associated with branding and customization. In a SPA that generally means injecting ...
3
votes
2answers
4k views

Renew access token for OAuth2 implicit grant

We want to use the OAuth2 Implicit Grant as it is proposed for single page applications. For JavaScript applications which don't have a classic web session. The applications only have access tokens ...
15
votes
1answer
14k views

OIDC Flow for SPA and RESTful API

I'm building a Single-Page App (SPA) and a RESTful API. The API needs security - certain users can only make calls to certain endpoints. I have an external Identity Provider (IdP (Okta)) that I want ...
9
votes
2answers
358 views

Can XHR patching prevent XSS side-effects?

XSS & Single-Page Apps I'm researching on web security, and have seen that token based authentication is good for CSRF prevention, distributed system architectures and processing performance. ...
3
votes
2answers
931 views

XSS on a single page web application

I'm practicing stored XSS attacks on my vulnerable single page web application. I want to achieve some kind of DoS attack, where the page keeps reloading from the server. I can easily inject window....
2
votes
1answer
2k views

Securing a JavaScript Single Page App with SAML

I would like to secure a JavaScript Single Page App with SAML. My server is powered using Node.js and serves a RESTful API. What are my options? Details: I have worked with OAuth2 in the past, but I ...
2
votes
1answer
3k views

Single Page Application session management

I have a Single Page Application which is fully HTML+JS+CSS (using frameworks such as jQuery and AngularJS) and a server side API using ASP.NET WebApi. The SPA is served in a server similar to a CDN ...
1
vote
1answer
2k views

CSRF tokens in Single Page Applications (JavaScript/Angular)

I have an AngularJS SPA served by Apache on a cheap web host. All communication to the backend is via Ajax REST calls to an expensive cloud server running Tomcat. How can the REST calls be protected ...
6
votes
2answers
426 views

JSON Web Token Security

I've been working with JSON Web Tokens and reading up on how to make an app more secure. When a user is a authorized, the token is signed, and a token will be placed in the Authorization Header. This ...
8
votes
4answers
2k views

Why do we trust session info over the wire but not an OAuth access token?

I've been spending a lot of time looking into building an API that needs to be accessible by a single page JavaScript application and how to make it as secure as possible. A lot of what I'm reading ...
4
votes
3answers
305 views

What's the best way to secure the responses in a single page web app after logout?

I've read some of the great responses to storing and passing session keys in a single page web application (i.e., a web "site" that runs mostly on the client-side, getting data from the server by ...
1
vote
0answers
1k views

Secure Single Page Application (SPA) served from a CDN

Is it possible to secure a Single Page Application (SPA) served from a CDN that communicates with a REST API, assuming the following: The front end communicates with a backend REST API using a token ...