alt Hacker NewsAre there cybersecurity concerns in the frontend? I would have thought you have to assume the client is untrusted and only do security work on the backend
Replies
freeplay • yesterday at 6:03 PM
Nailed it. Assume your client is compromised and/or malicious regardless of how it was built.
1. Not storing secrets properly or using hardcoded secrets
2. Wild use of webviews/iframes sometimes easily propagates as XSS in phones
3. Incorrect client-side OAuth 2.0 configuration e.g. with schema-based redirect URLs.
4. Not supporting high-enough API versions, which may prevent some OS-related weaknesses
5. The list is actually very long. Just few top of my mind.