Apply fundamental frontend security principles
Frontend code executes in an uncontrolled environment (the browser), meaning any data, tokens, or state on the client can be read, modified, or spoofed. To mitigate risks such as data leaks and infrastructure compromise, developers must adhere to these core principles:
- Zero Trust in Client Data: The client application is never a trusted party.
- Treat All Incoming Data as Untrusted: Regardless of the source, data must be treated as untrusted. This includes:
- User input
- URLs and query parameters
- Responses from external APIs (third-party services, public endpoints)
- Client-side storage (
localStorage,sessionStorage,IndexedDB) postMessageevents from other windows or frames- Cookies that lack the
HttpOnlyflag
- Client-side Validation is for UX, Not Security: Client-side validation improves user experience but does not protect the system. Any check affecting security or data integrity must be performed on the backend.