Web Application Security

🔑 Key Takeaway: Harden Web3 web apps against XSS and related OWASP classes, lock down backend storage, and plan frontend availability—because client compromise steals wallet-bound actions.

Providing a secure front-end (web application) for users to interact with your web3 protocol is often essential. Web application vulnerabilities have however been exploited in the past to steal user funds, and as such it's important to take web application security into consideration for your project.

Best practices

1. Utilize popular and well-maintained web application frameworks when developing your application.
2. Familiarize yourself with common web application vulnerabilities that may affect your decentralized application such as Cross-Site Scripting (XSS). Refer to the OWASP Top 10 for a comprehensive list.
3. Minimize the introduction of custom components in your framework. Ensure that any custom code undergoes thorough internal and external security testing.
4. Refer to the Infrastructure/DDoS Protection section for insights on ensuring high availability of your protocol’s front-end.
5. Lock down access to associated back-end services, such as S3 buckets, to prevent unauthorized access.
6. Consider deploying additional versions of your front-end on IPFS to ensure availability and resilience.

Further Reading

• Front End Web App overview: how the pages of this framework fit together
• Common Vulnerabilities: the specific flaw classes to design against
• Third-Party Script Security: CSP, SRI, and Trusted Types for external code
• Frontend Compromise Runbook: response steps when the app is serving malicious code