87 votes
Accepted

Preventing users from tampering with input

TL,DR: It's impossible to do so client side. Client side validation is just a client convenience, not useful to really validate anything. You don't want the client to mistype his email, putting an ...
  • 50.7k
25 votes

Preventing users from tampering with input

You'll have to validate it on the server side. You say that the number of possible permutations is too large - but the client side somehow did it, didn't it? If the server side doesn't have enough ...
  • 998
18 votes

OIDC Flow for SPA and RESTful API

Here is the difference between Implicit Flow and AuthCode Flow: Implicit Flow NOTE: As of April 2019, the Oauth Working Group no longer recommends the use of Implicit Flow for most cases because there ...
  • 1,331
12 votes
Accepted

Secure REST API and Single Page App by using external OAuth 2 Authorization Code

Firstly, and to be very clear, OAuth 2 is not an authentication protocol. If you wish to know the identity of the user, there are other protocols designed to solve this problem, such as OpenID Connect....
11 votes
Accepted

Can an end-user modify conditional rendering in React?

It's not just that they can modify the variable to show whatever dashboard they want - the fact is that they have full control over the app, can view all code, can view all data in the app, etc... The ...
8 votes
Accepted

Can XHR patching prevent XSS side-effects?

Are there any caveats to this approach? (security-wise) Yeah, it's not very thorough, you can get a new instance of the constructor from a new window object instead: XMLHttpRequest = null; var ...
5 votes

Why do we trust session info over the wire but not an OAuth access token?

If the attacker would've been able to get the access token, surely they can get the cookie storing the session information An XSS attack can't get to the cookie if you specify it with HttpOnly. It ...
5 votes
Accepted

How to ensure that only my single page app can make requests to an API

This sounds like preventing a CSRF attack. The Same Origin Policy will already prevent anything within your API from being read by another domain, but to prevent requests that makes changes to your ...
5 votes

Preventing users from tampering with input

The only way you can handle this is by authenticating the connection and controlling what happens in the browser. Authenticating the connection is of course possible, but to control the browser is ...
4 votes

Encrypting the API response in a single page app

A web browser is not a DRM platform, full stop. The state of the art in this general area are malware distribution techniques, and javascript obfuscation. Google is the best source for the latest ...
  • 3,359
4 votes

Encrypting the API response in a single page app

Your API should check to see who is making the call and perform any sort of restrictions on the server side. The way to deal with this is to implement server-side authorization and mitigate against ...
  • 9,111
4 votes

High security application in Angular - a bad idea?

The browser should be trusted with the user's data in any case. Whether you use a single-page app or a plain HTML page, you are toast if the browser is compromised. Single-page apps do not change ...
  • 12.7k
4 votes
Accepted

Is CSRF possible in an SSR SPA with cookie authentication?

Now if the user wants to delete their account, they could press the button, which would send a request to the API that authenticates requests only by Authorization header Ultimately, it sends a ...
3 votes
Accepted

Is a SPA vulnerable to the BREACH https security exploit?

From your link: To be vulnerable, a web application must: Be served from a server that uses HTTP-level compression Reflect user-input in HTTP response bodies Reflect a secret (...
3 votes
Accepted

Single Page Application session management

Looking at the two options you presented, sessionStorage or HttpOnly cookies, there is a trade-off. You are correct that if you use cookies, you need a CSRF token, and if you use sessionStorage and ...
  • 35.5k
3 votes

CSRF tokens in Single Page Applications (JavaScript/Angular)

In order to implement CSRF protection, you need a token that is secret in the sense that it can't be calculated by an attacker. You can use a modification of the encrypted token pattern from the OWASP ...
3 votes

Is there a way to protect against fake messages by an SPA that consumes a webservice directly?

Just to be clear, your scenario is: You have a web service, which requires authentication to use. Your customer has a web app, the server of which acts as a client of your web service. You are ...
  • 40.3k
3 votes
Accepted

Is there a current best practice for authorizing an SPA to get/post to API

The general best practices are to use SSO/client auth. But since they don't apply to you, you can consider this approach: If you trust your users to not share the unique links that you passed sent to ...
  • 3,191
3 votes

Content Security Policy applied to Single Page Applications: Is it worth it with unsafe-inline?

does applying 'unsafe-inline' render CSP more or less pointless? Preventing XSS is one of the main benefits of a CSP. If you need to allow inline scripts, that benefit is mostly gone. But there are ...
  • 29k
2 votes

JSON Web Token Security

Securing User Credentials – Session Cookies Vs. JWTs: - Implement HTTPS on your server, and the login form is posted over this secure channel - Store the session ID in a secure, HTTPS-only cookie ...
  • 34
2 votes

JSON Web Token Security

Send the token over TLS. Sign the token with a couple of private/public keys (i.e. RSA, ECDSA) to prevent tampering (You don't use a secret shared!). If your token gets stolen, the attacker can only ...
  • 190
2 votes

Why do we trust session info over the wire but not an OAuth access token?

The problem is that access tokens are not bound to the client. Hence there is no way to know if an access token was issued for your client or for another client. Basically, from OAuth 2.0 point of ...
  • 6,921
2 votes

How to ensure that only my single page app can make requests to an API

It sounds like a situation similar to CSRF attacks, so it should be addressable with anti-forgery tokens. Anti-forgery tokens should achieve what you need. Each time you get a web request, you ...
2 votes

Renew access token for OAuth2 implicit grant

If you control the CAS then it is upto you how you access a new access token. Since your user has already authorised the SPA using your CAS, if the session is still valid with the CAS there is no need ...
2 votes

Can XHR patching prevent XSS side-effects?

Even if this would work and you could block JavaScript from performing XMLHttpRequests - which as shown by @Alexander is not the case (ActiveXObject would be another alternative) - it doesn't really ...
  • 29k
2 votes

Is CSRF possible in an SSR SPA with cookie authentication?

Firstly, it's important to understand the following: you should implement something to authenticate a user and you should implement something to authenticate a request (Anti-CSRF). CSRF Attack use a ...
  • 1,049
2 votes

Is a single page application naturally breaking the same-origin policy?

If you want to avoid making cross origin requests, host your frontend and your API on the same origin. If you host them on different origins, by definition you must make cross origin requests. And if ...
  • 64.5k
2 votes
Accepted

Implicit flow login from SPA

I presume you're referring to an OAuth 2.0 Implicit Flow. I think you're wondering why you need to direct away from your SPA for the user to authorize your app (by logging in, and usually selecting ...
  • 3,988
2 votes

Which grant type : Implicit or Auth code (with No secret key) is suitable for Single Page Application(SPA)?

You don't need the client secret, you should use PKCE instead. There is a new IETF draft about best practices for SPAs
2 votes
Accepted

What was the point of Implicit Grant Flow in OAuth 2.0?

The already mentioned advantages in responsiveness and simpleness for some clients (trade-offs in security are also mentioned in the spec): The implicit grant is a simplified authorization code flow ...
  • 101

Only top scored, non community-wiki answers of a minimum length are eligible