Skip to main content

Questions tagged [single-page-app]

A single page app (SPA) is a web application using only one HTML page. JavaScript is commonly used to modify the single page, and AJAX to fetch data from the server.

Filter by
Sorted by
Tagged with
1 vote
0 answers
45 views

Content security policy for script-src directive

I have a web app that is built using Vite for the react front-end part and uses .net API backend. The backend also configures a static file service for the prebuild frontend files but otherwise ...
Robert Koritnik's user avatar
0 votes
1 answer
129 views

Secure access and refresh token handling in a SPA

I am trying to figure out how to handle access and refresh tokens securely on the front end in a SPA. After doing a lot of reading, I still have questions/doubts about the proposed solutions I found ...
tech-ebe's user avatar
1 vote
0 answers
69 views

Session/cookie expire time, match access token or refresh token from AD?

I am tasked with moving away from implicit flow in a SPA. It is a basic solution consisting of a react SPA and a .net API, on the same domain. This web app is a case management solution that deals ...
ryansan's user avatar
  • 113
0 votes
1 answer
110 views

Best practises regarding authentication in SPA/API solutions with SSO

There is really not that great information on what the best practices are for auth in SPA/API solutions. Most of them just say use JWTs and auth code flow in the SPA. There is a ton of information ...
ryansan's user avatar
  • 113
0 votes
0 answers
172 views

Progressive profiling with auth0: Security when communicating with auth0 actions

I currently try to implement progressive profiling with auth0 according to: https://auth0.com/blog/using-redirect-with-actions-to-gather-user-info-and-increase-conversions/ to gather first name and ...
Christian's user avatar
  • 101
2 votes
2 answers
597 views

How to implement Double Submit Cookie with Encryption or HMAC

I'm trying to implement the Double Submit Cookie pattern with extra protection using encrypted or signed CSRF tokens. I'm working with a Single Page Application and a stateless API. The purpose of ...
AFP_555's user avatar
  • 121
1 vote
0 answers
217 views

Is getting OAuth2 token safe to fetch client-side and pass to server-side?

I'm integrating my application with external service. My application will exchange data with the external service in context of some user. Data exchange will be done in background on server-side. User ...
Politechniczny's user avatar
15 votes
6 answers
7k views

Preventing users from tampering with input

Let's say that I have a single-page web app written in JavaScript and a server-side API, both changeable by me. The app calculates some values based on user input and POSTs these to the API. The ...
TrueWill's user avatar
  • 365
3 votes
0 answers
326 views

Auth0 token exchange vs Google Firebase token exchange

I'm researching our options for securing access to a single-page web app and a mobile app. The apps communicate with a REST API which, based on the authenticated user's identity, will return ...
DrPep's user avatar
  • 131
9 votes
2 answers
15k views

Is it possible to set an HttpOnly Cookie from one domain to another subdomain

I am pretty sure that the answer to my question is no, but I have been have a hard time finding an answer through official documentation or other posts here. Here is simple use case for some context: ...
briancaffey's user avatar
0 votes
0 answers
148 views

Multiple user specific APIs with a single Authentication Server

I’m currently in need of some clarification for an authentication/overall strategy. First I will describe the use case and then the questions that arise for me. Use Case I want to have a single docker ...
TM.96's user avatar
  • 1
1 vote
0 answers
485 views

Implement an SPA with IFrames, but with Single Sign-on

I want to build an SPA with ASP.NET Core (Blazor server side) which some IFrames redirecting to other applications. In this example I have f.e. the SPA, Grafana to show graphs and Node-Red, but there ...
Max R.'s user avatar
  • 141
0 votes
0 answers
222 views

Delegating to multiple auth providers from a single page application

Consider a use-case in which a single page application using an OAuth identity flow has to use one of many possible identity providers, as determined by what user is logged in. More specifically, I ...
Dan's user avatar
  • 123
0 votes
1 answer
698 views

CSRF token in SPA login JSON response?

Is it safe to include the CSRF token as part of an HTTPS successful login JSON response in an SPA? If not, is there a better mechanism for sending it which avoids the Double Submit Cookie pattern? ...
java-addict301's user avatar
1 vote
0 answers
154 views

SPA Oauth2 and Backchannel (Client)

I am having a problems defining the flow of an application that is supposed to be authenticated / authorized securely with an SPA frontend. Currently using an SPA with a Spring application server as a ...
user2742982's user avatar
2 votes
1 answer
581 views

Is OAuth 1 less secure than OAuth 2 in an SPA

We are writing a pure javascript front-end (in angular) for an API that still uses OAuth 1 for legacy reasons. Being pure javascript means the consumer secret is part of the code that gets downloaded ...
Jan Hudec's user avatar
  • 541
6 votes
1 answer
1k views

Split a JWT between payload and signature

Context: I'm looking at storage solutions for JWT tokens on a single page application. Storing the JWT in the local storage is unsafe and prone to XSS attacks. Storing the JWT in a secure / HTTP only ...
HHK's user avatar
  • 163
1 vote
0 answers
381 views

Oauth2.0 | How to manage user session in Single Page application running in an iframe?

I'm new to security domain, and recently I have learned about Oauth2.0/OpenID connect and JWT tokens. I have an existing REST based web application where I need to implement security. Server ...
A.Huzaifa's user avatar
3 votes
4 answers
5k views

Content Security Policy applied to Single Page Applications: Is it worth it with unsafe-inline?

I have a website developed using VueJS (i.e. its a single page application). I've been looking at implementing Content Security Policy headers. As I tested out the header values I would need, I ...
F_SO_K's user avatar
  • 131
5 votes
2 answers
836 views

Why *is* PKCE recommended for single page JavaScript apps?

This question is essentially the opposite of Why isn't PKCE encouraged for Single-Page Apps?. In recent years, most OAuth API vendors seem to be have become unanimous in recommending that ...
Jimmy Breck-McKye's user avatar
0 votes
1 answer
211 views

Is there a current best practice for authorizing an SPA to get/post to API

I have an API and an SPA. The SPA is all anonymous but I want to ensure the caller of the API is authorized to do so. It seems that all of the OAuth best practices, e.g. PKCE, depend on a user ...
Chris Rockwell's user avatar
4 votes
2 answers
703 views

Using OAuth SPA app to provide third party with access token

Say I had a centralized OAuth 2 authentication server, a Single Page Application (SPA) in an electron app, and a third-party server. The user launches this SPA, goes through the PKCE flow to obtain an ...
Eamonn Nugent's user avatar
2 votes
1 answer
2k views

Difference between Form Post Response and Authorization Code

I am trying to find the best OAuth2 mechanism for our VueJS Single Page Application (SPA) hosted on our own backend. From my research, Authorization Code should be sufficient, as long as the redirect ...
Murali Varma's user avatar
2 votes
1 answer
3k views

Using a persistent httpOnly cookie for authentication? (SPA)

So I'm building an application that needs authentication, I'm wondering if there's an security concerns with using a persistent httpOnly cookie to store user authentication with a SPA? (only 1 server. ...
Eden Moss's user avatar
6 votes
2 answers
1k views

Auth code grant /w PKCE for SPAs

I'm a security newb trying to find out how to secure my SPAs, and am totally lost in the forest of RFCs, BCPs, drafts and blog posts. If possible, I'd like to serve my SPAs statically from a cdn. At ...
AleksG's user avatar
  • 163
4 votes
0 answers
464 views

Are the trade offs for putting an auth token in an http-only cookie for an SPA worth it?

I've been building a web app (rails api + react SPA) for learning / fun and have been researching authentication. The most commonly recommended approach for authenticating SPAs that I have read is to ...
apog's user avatar
  • 41
1 vote
0 answers
316 views

SAML Passing a JWT token from the API to the SPA application

We are trying to implement the SAML 2.0 protocol and I stumbled upon a problem related to passing the token from the API to the client SPA application. The authentication flow goes like this: the ...
cip123's user avatar
  • 11
3 votes
1 answer
710 views

Can an end-user modify conditional rendering in React?

On my Single Page App I am using MSAL.js to authenticate users and to also extract the groups they belong to by using Microsoft Graph endpoints. I save to a variable the Specific groups the user ...
user5950's user avatar
  • 133
0 votes
0 answers
276 views

Is it useful to have separate access tokens and refresh tokens if they're going to be stored on the client-side as cookie?

(This is a followup to my question about a general security scheme here) As part of an authentication scheme for a single-page application + REST API, I planned to provide authenticated clients with ...
DylanSp's user avatar
  • 134
3 votes
2 answers
319 views

Is this security scheme using passwords, short-lived access JWTs, and long-lived refresh tokens a good way to secure a REST API?

I'm trying to secure a REST API that I'm using as a backend for a single-page application. The API provides access to read/create/modify/delete protected resources, based on a set of permissions ...
DylanSp's user avatar
  • 134
0 votes
2 answers
473 views

What was the point of Implicit Grant Flow in OAuth 2.0?

I've read a lot about Implicit Grant Flow and when it should be used, but I can't wrap my head around a use case for where it would have made sense over the Authentication Code Grant Flow before PKCEs ...
johnnyodonnell's user avatar
3 votes
0 answers
229 views

CSP for iFrame without any src attribute

I am looking for recommendations on how to implement our CSP policy. We have an Angular SPA application, that has an iframe without any src attribute. We populate the content of the iframe dynamically ...
theIceBandit's user avatar
-1 votes
1 answer
131 views

Fundamentals of securing a web app? [closed]

I am trying to build an app that deals with finance, specifically crypto-currency. What are the fundamentals (preferably in point form, but I'd appreciate explanations too) of securing such an app ...
YulePale's user avatar
  • 133
0 votes
3 answers
160 views

Is there a way to protect against fake messages by an SPA that consumes a webservice directly?

I develop a webservice currently and communication might be a bottleneck. It would be at least 100ms faster if I could access the webservice from the browser directly instead of sending the messages ...
inf3rno's user avatar
  • 489
1 vote
1 answer
216 views

Which grant type : Implicit or Auth code (with No secret key) is suitable for Single Page Application(SPA)?

I went thru multiple posts saying how implicit grant is a security risk and why auth code grant with AJAX request to Authorization server should be used after redirecting to application (without ...
Pratik Joshi's user avatar
3 votes
1 answer
667 views

Storage of API authentication token in single-page-applications

I'm building a JSON API. For authentication I plan to use a random-token based approach, with the random token having 256 bits of entropy and generated using a CSRNG. A hash of the token will be ...
Alex Edwards's user avatar
2 votes
2 answers
1k views

OIDC SPA Keycloak refresh_token storage location

I have Single Page Application based on Open ID Connect flow (keycloak). I wonder what are the security considerations for refresh token storage - what are the advantages and disadvantages for ...
TinyAPI's user avatar
  • 21
4 votes
4 answers
2k views

Is it possible to truly hide content behind a paywall in a single page app?

I would like to hide certain content behind a paywall in my VueJS app. In googling around... Some tutorials recommend storing the currently logged in user in local storage. And then before showing ...
Adam Zerner's user avatar
1 vote
0 answers
139 views

Is the OAuth implicit flow too insecure for serverless single page web applications?

Assuming the need for OAuth Imagine an application that is: A single page web application hosted on S3 Authenticated using implicit OAuth flow implicit Have the web application access resources ...
David Alsh's user avatar
1 vote
0 answers
1k views

CSRF protection and Single Page Apps on hosted on S3 (with no backend.)

I have a webapp written in js that runs on AWS S3. There is no way to initialize a secure CSRF token on page load since there is no backend server. The token has to be retrieved via an AJAX call to my ...
zeros-and-ones's user avatar
0 votes
1 answer
2k views

XSS prevention in single page web applications

One of my colleagues suggested the following methods to secure against XSS attacks in my angular5 application: Enable X-XSS-Protection header Enable X-frame-options header Adding proper content ...
shamon shamsudeen's user avatar
1 vote
0 answers
226 views

Restrict Public API To Access From Single App

I have a REST api on a server and an application for android phones that mostly makes calls to that api and presents the info to the user. Because the application needs to be a quick way to lookup ...
Nicolás Marzano's user avatar
0 votes
2 answers
202 views

Non-standard OIDC flow: How safe is this?

I have been made aware of an application, at a client, that claims to use OIDC to authenticate users. This is however done via a non-standard flow that I find hard to assess from a security standpoint....
Björn Vildljung's user avatar
2 votes
1 answer
2k views

Implicit flow login from SPA

Looking at the implicit flow to login with https://github.com/IdentityModel/oidc-client-js and https://github.com/IdentityServer/IdentityServer4.Samples/tree/release/Quickstarts/7_JavaScriptClient . ...
ChrisFletcher's user avatar
4 votes
0 answers
569 views

Concepts to support local and external authentication: JWT, Cookies, HttpOnly, ...?

I am trying to figure out the correct authentication strategy and concepts for a single page web application (SPA) featuring local login as well as 3rd party login (e.g. Google, Auth0). Unfortunately, ...
user1211286's user avatar
2 votes
0 answers
2k views

Protecting frontend code for SPA + Restful API with OIDC

I've got an Angular 1 SPA with a Restful API that I'd like to restrict access to. As I understand, typically the OIDC Implicit flow is designed just for this. However, I consider the frontend SPA code ...
hhp's user avatar
  • 21
5 votes
2 answers
4k views

Is CSRF possible in an SSR SPA with cookie authentication?

I have a Single-Page Application, which is basically a consumer to my API which authenticates using the Authorization header. Now because I do server-side-rendering, I need to authenticate on the ...
OverCoder's user avatar
  • 155
1 vote
2 answers
3k views

Is a single page application naturally breaking the same-origin policy?

Assume that you have a web application. The backend API is deployed at api.example.com and your frontend SPA is deployed at frontend.example.com. When you open it you download all the resources to ...
Qingbao's user avatar
  • 101
2 votes
1 answer
181 views

Evaluating spam score for a single page application

I am developing a single page application with a behaviour similar to google Maps and I want to avoid spam as much as possible. Users can register on my website to get access to an API KEY. Then, on ...
Gary Olsson's user avatar
4 votes
0 answers
518 views

Security Implications of a Single Page E-Commerce Application [closed]

I'm asking here because there seem to be zero resources online about this kind of thing. I've built an single page e-commerce website that uses Stripe, Laravel, VueJS, Vue Router and Vuex. Everything ...
user373688's user avatar