backbone securityissues

Question

What are the possible security risks one may face while developing a backbone app.Can someone tell me the best practices to mitigate such risks.

as in the router any users can find out the services being called

Answer 1

The secret to securing a Backbone app, or any other client, is that you don't rely on client-side validation. Be sure to validate on the server.

For example, if you were building a banking app, you wouldn't use Backbone to transfer $100 between a user's accounts and then send back to the server the new account balances as model updates. You would instead send to the server the user's intent to transfer $100 and let the server send back the new balances. This way the server can safely determine the user's authorization to make such a transfer between accounts, determine if sufficient funds exist, etc..

Client-side validation is nice to help reduce round-trips and give immediate feedback to the user, but it shouldn't be thought of as a method for securing an app. E.g. Validate the format of an email address or the strength of a password on the client before sending it to the server (where it should be validated again server-side) is a good example of client-side validation.

As for web services, there are different ways to protect them. You can use HTTPS or token-based authentication just for example.