JavaScript has some vulnerabilities that can be prevented by following some simple checklists and simple implementations. Those implementations can be in client-server communications or DOM manipulation, but you always need to be careful not to forget them.
Here are some tips for using JavaScript:
- Always use an authenticated and encrypted API when possible. Remember that JWT isn't encrypted by itself; you need to add the layer of encryption (JWE) to have the whole JSON.
- Always use SessionStorage if you want to store an API token.
- Always sanitize the HTML input from the user before sending it to the server.
- Always sanitize the HTML before rendering it to the DOM.
- Always escape any RegeExp from the user; it will be executed, to prevent any CPU thread attack.
- Always catch errors and don't show any stack trace to the user, to prevent any code manipulation.
Here are some tips on what not to do when using JavaScript:
- Never use eval(); it makes your code run slowly and...