Common Frontend Security Attacks

Frontend security attacks target websites and web applications through vulnerabilities in client-side code, user inputs, browser behavior, and communication with backend services. Understanding these attacks helps developers protect user data and build more secure applications.

1. Cross-Site Scripting (XSS)

Cross-Site Scripting (XSS) is a security vulnerability that allows attackers to inject malicious scripts into a webpage. These scripts may run in the browsers of users who visit the affected page and can be used to steal accessible data, impersonate users, or modify page content.

How to prevent XSS:

• Use safe DOM APIs, such as textContent, instead of inserting untrusted input with innerHTML.
• Apply context-appropriate output encoding when displaying untrusted data.
• If users need to submit HTML, sanitize it with a trusted HTML sanitization library before rendering it.
• Configure a Content Security Policy (CSP) as an additional layer of protection.

2. Broken Client-Side Access Control

Broken client-side access control occurs when a website relies on frontend code to determine what users can access or what actions they can perform. For example, hiding an administrator button from regular users does not prevent them from attempting to call the underlying API directly.

How to prevent broken client-side access control:

• Enforce authentication and authorization on the server for every protected operation.
• Check user permissions before returning sensitive data or processing requests.
• Treat frontend checks as a way to improve the user experience, not as a security boundary.
• Test whether users with different roles can access restricted pages, data, and API endpoints.

3. Third-Party JavaScript and Supply Chain Attacks

Websites often use third-party scripts and libraries for analytics, payments, advertisements, and other features. If a dependency or external script is compromised, attackers may introduce malicious code that runs within the website and potentially accesses data available to that code.

How to prevent third-party script and supply chain attacks:

• Use trusted libraries and verified script sources, and remove dependencies that are no longer needed.
• Keep dependencies updated and review changes for suspicious or unexpected behavior.
• Use Subresource Integrity (SRI) for supported externally hosted scripts when appropriate.
• Apply a restrictive Content Security Policy (CSP) to control which script sources the browser can load.

4. Sensitive Data Exposure in Frontend Code

Sensitive data exposure occurs when confidential information is included in frontend code or sent to the browser unnecessarily. For example, placing a private API key in a JavaScript file does not keep it secret because users can inspect downloaded code and network requests.

How to prevent sensitive data exposure:

• Never embed private API keys, passwords, or server credentials in frontend code; keep secrets on the server.
• Return only the data each user needs and is authorized to access.
• Review production bundles, source maps, logs, and network responses for accidental exposure.
• Restrict public API keys where supported, and apply appropriate usage limits and permissions.

5. Insecure Client-Side Storage

Insecure client-side storage occurs when sensitive information is stored in browser storage without appropriate consideration of the risks. For example, storing session tokens or confidential personal data in localStorage can expose that information to JavaScript running in the same origin, including malicious scripts introduced through an XSS vulnerability.

How to prevent insecure client-side storage:

• Avoid storing sensitive information or session identifiers in localStorage when safer alternatives are available.
• For browser-based sessions, consider appropriately configured cookies with HttpOnly, Secure, and SameSite attributes.
• Store only the minimum information required, clear sensitive data when it is no longer needed, and validate data retrieved from browser storage before using it.

6. Clickjacking

Clickjacking is an attack in which a malicious website tricks users into interacting with a hidden or disguised webpage element. For example, a user may believe they are clicking a harmless button while actually activating a control on another website.

How to prevent clickjacking:

• Configure the HTTP response header Content-Security-Policy with the frame-ancestors directive to restrict which websites can embed the page.
• Use the X-Frame-Options response header as a legacy compatibility measure where appropriate.
• Require server-side authorization and suitable confirmation for sensitive actions.
• Review embedded content and use iframe sandboxing when loading untrusted pages.

7. Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery (CSRF) occurs when an attacker tricks a user's browser into sending an unwanted request to a website where the user is already authenticated. If the website accepts the request without sufficient protection, an action such as changing account settings may be performed without the user's intention.

How to prevent CSRF:

• Use anti-CSRF tokens for state-changing requests when required by the application's authentication design.
• Configure authentication cookies with an appropriate SameSite attribute.
• Validate request origins using the Origin header or, where appropriate, the Referer header as an additional safeguard.
• Never use GET requests for operations that change data or account state.
• Enforce authorization and CSRF protections on the server; frontend checks alone are insufficient.

8. Insecure Cross-Origin Communication

Web applications sometimes exchange data with other origins using APIs, postMessage(), and embedded frames. Insecure cross-origin communication can occur when a website trusts messages or responses from unverified origins, potentially allowing attackers to influence application behavior or expose information.

How to prevent insecure cross-origin communication:

• Configure Cross-Origin Resource Sharing (CORS) on the server to allow only the origins that require access.
• When using postMessage(), specify an exact target origin whenever possible and validate event.origin and incoming message formats.
• Do not treat CORS as authentication or authorization; protect sensitive API operations separately and avoid sending sensitive information to untrusted origins.

9. Security Misconfiguration and Weak Browser Security Controls

Security misconfiguration occurs when a website fails to configure available security features correctly. Examples include a missing Content Security Policy, overly permissive script sources, missing security headers, or unsafe iframe permissions. These weaknesses can make other attacks easier to carry out.

How to prevent security misconfiguration:

• Configure and test a suitable Content Security Policy before enforcing it in production.
• Set appropriate HTTP security headers, including X-Content-Type-Options and framing restrictions.
• Use HTTPS throughout the website, redirect insecure HTTP requests where appropriate, and apply HTTP Strict Transport Security (HSTS).
• Restrict iframe permissions and regularly review security settings to remove unnecessary access or features.

10. Man-in-the-Middle (MitM) Attacks

A Man-in-the-Middle (MitM) attack occurs when an attacker intercepts or alters communication between a user and a website. This risk is greater when connections use unencrypted HTTP or when users are tricked into trusting an unsafe connection. Although MitM attacks are not exclusive to frontend development, they can affect data exchanged between browsers and web servers.

How to prevent MitM attacks:

• Serve the entire website over HTTPS using a valid TLS certificate.
• Configure HTTP Strict Transport Security (HSTS) to instruct browsers to use HTTPS for the domain.
• Avoid mixed content, where an HTTPS page loads insecure HTTP resources.
• Never ask users to ignore certificate warnings or disable browser security checks.
• Protect sensitive requests and validate authorization on the server, even when HTTPS is enabled.