Information about Front-End is scattered across the web, so I compiled this guide for reference.
Want to learn advanced techniques? Check out our premium courses.
正文
Front-End Security: 10 Popular Types of Attacks and Best Practices to Prevent Them
Your web application's front end is the first part seen everywhere. It’s the first thing that regular users and potential customers look at but it’s also the first thing that an attacker sees—it's the main door to your
Front-end security demands have increased a lot over the past decade. There are more sophisticated attacks taking place against web application front ends these days, whereas in the past most attacks were straightforward, resulting in easier detection. More recently, attacks have become stealthier, harder to detect, and often discovered far too late.
Employing proactive techniques, like engaging security from the start, reducing
, and nurturing a healthy cybersecurity culture within an organization, can help reduce the attack surface of any web application's front end.
Top 10 Front-End Security Risks and Best Practices to Prevent Them
Let's look at some popular front-end security issues, and how you can fight different
to prevent them with the industry's best practices.
XSS attacks are one of the largest and most dangerous forms of attack. They're crafted in such a way that they inject code into a web application, which ends up performing malicious actions when accessed by an end user.
XSS attacks are drawn to a lack of sanitization in a web application's input and output, which can lead to a variety of attacks.
rank as one of the largest types of attacks under the XSS attack umbrella, as they're simply performed by replacing legitimate parts of a web page with similar-looking, yet dangerous, elements. For example, checkout buttons can be replaced with buttons redirecting users to
, legitimate download buttons can be replaced with buttons resulting in malware downloads, and more.
With XSS attacks, an attacker can inject JavaScript libraries, which then execute on the client side—logging the user's IP address, geolocation and other personal details. These can then be used by the attacker to target the end user with personalized scams or
With code injected by an XSS attack, cryptomining can be performed on end users' devices as well. While it may already seem to slow down a single device, hundreds or thousands of users visiting a web application every day means crypto mining scripts running on your web application can unknowingly cause not only slowdowns but also heating issues on users' devices. This sort of effect on your web application can lead to a negative experience on their part.
Protection against XSS attacks can be achieved by the proper sanitization of inputs made into your web application, as well as by filtering inputs correctly. For example, limiting mobile numbers to digits only or not allowing special characters in names can yield a substantial benefit by preventing most injection attacks on your web application.
More Details
There are a few more points worth noting. First, browser compatibility varies across different browsers. Second, performance optimization is crucial when handling large amounts of data. Finally, key management is also an important consideration.
Feel free to ask questions in the comments - I'll reply as soon as possible.
Reference: Front-End Security: 10 Popular Types of Attacks and Best Practices ...
