Micro Frontends and Security

on YouTube ↗44m

" summary

Explains when micro frontends actually break security and gives concrete fixes: avoid leaking powerful session cookies over bearer tokens by using browser cookies plus a gateway that exchanges them for backend tokens; protect injected assets with subresource integrity (sha384) served from a discovery feed; sandbox server-side modules with Node.js VM sandbox and custom require/timeouts; enforce and report violations with CSP report-only and correct CORS headers; notes Webpack Module Federation needs a discovery + integrity step to be safe.

AI-written summary · about

" chapters (15)

1. 0:00Micro frontends security intro
2. 1:30Speaker intro
3. 3:39Why micro frontends need security
4. 7:29Distributed code risks
5. 9:19OWASP threats for micro frontends
6. 11:48Authentication flaws
7. 19:22Session cookies mitigation
8. 21:52Code integrity checks
9. 26:08Injection challenges
10. 27:51Server composition risks
11. 29:15Sandboxing with Node.js VM
12. 32:46CSP for micro frontends
13. 36:16CORS and security headers
14. 38:01Q&A: Security mistakes
15. 41:12Q&A: Social engineering risks

" related talks

• 32mSecurity-First Web AppsAtila Fassina · JSHeroes 2025
• 27mMicro-frontends: anti-patternsLuca Mezzalira · EnterpriseNG 2021
• 52mMicro frontends: prepare for the ridePaulius Kimbartas · Build Stuff 2021
• 48mMicrofrontend Architecture – technical implementation.Reinis Pakers · DevClub.lv 114th Frontend focused event
• 24mScaling Frontend Development using Micro-frontendsMashhood Rastgar · NG-MY 2019
• 28mHow to Protect Java Microservices and React.js Micro frontendsNishith Singh · Commit Your Code 2024
• 19mCritical Security Mistakes in Frontend ApplicationsDan Neciu · UtahJS Conf 2023
• 58mPractical Secure Development and Operations with JavaScript in 2020Johan Coppieters · JSConf Belgium 2020