Skip to main content

Security Guidelines

Security Guidelines for Implementing a Frontend-only Authorization (FoAz) Service

Implementing a FoAz service requires careful consideration of multiple security aspects. The following guidelines provide a framework for ensuring robust security while implementing a FoAz service:

1. Secure Communication​

All communication between the frontend, FoAz service, and backend should be encrypted using TLS (Transport Layer Security). This ensures that all data transmitted over the network is secure and cannot be intercepted or altered.


Use HTTPS for all communication and ensure that the TLS version is up-to-date.

2. Token-based Authentication​

Use JWT (JSON Web Tokens) or similar token-based systems for authentication. Tokens should be signed and possibly encrypted, depending on the sensitivity of the information they contain.


Ensure that tokens are securely stored on the client side (e.g., HttpOnly cookies) and are not accessible via JavaScript to prevent Cross-Site Scripting (XSS) attacks.

3. Granular Application-Level Permissions​

Your authorization policies should be as granular as possible. This means that you should define access permissions at the level of individual resources and actions of the application itself. Use policy engines that support advanced policy models like RBAC, ABAC, or ReBAC. Do not rely on infrastructure level access controls (including those of the services targeted by FoAz) instead of application level access controls.


Regularly review and update your access policies to match changing requirements and to remove permissions that are no longer needed.

4. Secure Frontend Code​

While FoAz offloads authorization work from the frontend, frontend code can still be a security vulnerability. Ensure that your frontend code does not contain any sensitive information and that it is not vulnerable to common web application vulnerabilities like XSS or CSRF attacks.


Adopt secure coding practices, use security linters, and perform regular code audits to identify and fix potential security issues.

5. Secrets Management​

Sensitive data like API keys, tokens, and secrets should be securely managed. Use a vault solution to securely store and manage secrets.


Ensure that secrets are never included in your frontend code or exposed in any way. Use your FoAz service to securely inject secrets when needed.

6. Regular Security Audits​

Regularly conduct security audits of your FoAz implementation. This includes code audits, reviewing access logs, and checking for any anomalies or suspicious activities.


Consider using automated security scanning tools and engage third-party security experts for periodic in-depth audits.

7. Incident Response Plan​

Have a plan in place to respond to security incidents. This includes detecting the incident, containing it, and notifying affected parties.


Regularly update and test your incident response plan to ensure that you are prepared for any potential security incidents.

Remember, security is a continuous process and requires regular review and updating of your practices and systems.