<\/span><\/h2>\n\n\n\nIn the case a system is dependent on both, a backend and a frontend, or a server-side and a client-side, it is important to still give the same level of security to the two. Failure to do so can represent a huge impact on a business. One common scenario where many Junior developers fail is to properly ensure validation of the data. For example, our application has a login page, which contains a form with two input boxes, one for the username and the other for the password.<\/p>\n\n\n\n
It has become standard to provide error messages on any of this information prior to submitting the login form, or in other words, making a request to an API to authenticate the user. But what do you think would happen if the password input box displays in plain-text the password of the user as he is typing, instead of hiding the password which happens whenever the attribute type<\/code> <\/span><\/strong>is set as password<\/span><\/strong><\/code>? Certainly, anyone walking nearby could see the user’s password representing in a user-theft vulnerability.<\/p>\n\n\n\nBut that is one case. Can you think of the scenario where someone else has hacked the user’s computer and the hacker is recording everything the user does on the computer? Due to a failure in the development on the client-side, we allowed hackers to get more sensitive information from the user.<\/p>\n\n\n\n
Now, let’s think of the scenario where the client-side is secure, but the server-side lacks security. For example, our API has a GET endpoint called \/car<\/strong><\/code> and it receives an id<\/code> <\/strong><\/span>query parameter to get a specific car record. The id<\/strong><\/code>‘s data type is a number. Unfortunately, the API doesn’t validate the id<\/code> <\/strong>parameter and also doesn’t parameterize its value, but instead, it directly concatenates the id<\/strong><\/code> value in the following SQL script. For the purpose of this example, we are going to say that the id<\/code> <\/strong>value is 1<\/strong>.<\/p>\n\n\n\nSELECT * FROM Cars\nWHERE CAR_ID = \t1<\/code> <\/pre><\/div>\n\n\n\nHere, it doesn’t seem to be a major risk. However, someone with basic SQL knowledge will know this is a case of SQL injection. Let’s change the value of id<\/strong><\/code> to 1 or CAR_ID != 1<\/strong><\/code>, making our SQL script look like the following:<\/p>\n\n\n\nSELECT * FROM Cars\nWHERE CAR_ID = \t1 or CAR_ID != 1<\/code><\/pre><\/div>\n\n\n\nNow, our query will return all of the car records, and if the user is not supposed to have access to cars he didn’t create then a hacker will now have full access to the list of cars available in the database. <\/p>\n\n\n\n
Therefore, making the assumption that making one side (the server-side or the client-side) more secure than the other is not a good justification to make the other end less secure. As software development security practices evolve, hacking practices do the same. There are smart people out there with malicious intentions who always come up with innovative ways to break into a system. <\/p>\n","protected":false},"excerpt":{"rendered":"
Software Development has evolved dramatically over the last 10+ years. Prior to the development of Frontend JavaScript frameworks, multiple projects relied on the backend, including its security. With more advances on the client-side, the level of responsibility has increased equally on both ends. However, is the JavaScript Client-Side Secure? In short, JavaScript client-side applications are … Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":638,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"nf_dc_page":"","_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[16,12],"tags":[],"class_list":["post-636","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-javascript","category-programmers-knowledge","generate-columns","tablet-grid-50","mobile-grid-100","grid-parent","grid-50"],"_links":{"self":[{"href":"https:\/\/www.becomebetterprogrammer.com\/staging\/4563\/wp-json\/wp\/v2\/posts\/636","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.becomebetterprogrammer.com\/staging\/4563\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.becomebetterprogrammer.com\/staging\/4563\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.becomebetterprogrammer.com\/staging\/4563\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.becomebetterprogrammer.com\/staging\/4563\/wp-json\/wp\/v2\/comments?post=636"}],"version-history":[{"count":3,"href":"https:\/\/www.becomebetterprogrammer.com\/staging\/4563\/wp-json\/wp\/v2\/posts\/636\/revisions"}],"predecessor-version":[{"id":2518,"href":"https:\/\/www.becomebetterprogrammer.com\/staging\/4563\/wp-json\/wp\/v2\/posts\/636\/revisions\/2518"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.becomebetterprogrammer.com\/staging\/4563\/wp-json\/wp\/v2\/media\/638"}],"wp:attachment":[{"href":"https:\/\/www.becomebetterprogrammer.com\/staging\/4563\/wp-json\/wp\/v2\/media?parent=636"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.becomebetterprogrammer.com\/staging\/4563\/wp-json\/wp\/v2\/categories?post=636"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.becomebetterprogrammer.com\/staging\/4563\/wp-json\/wp\/v2\/tags?post=636"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}