How to communicate securely between shell app and micro application(frontend) via pubsub

user_1131531 0
Viewed 633

I have a shell application which is the container application that performs all the API communication. Also, I do have multiple Micro application which just broadcast the API request signal to shell application.

Now, keeping the security in mind, as a shell application how it can ensure that API request signal is coming from the trusted micro app which I own.

To be very precise, My ask is, is there a way to let shell application know that the signal is coming from the micro app that it owns and not from any untrusted(like hacking, XSS) source

micro-frontend publish-subscribe angular typescript javascript
3 Answers

As per the Micro-Frontend architecture each Micro Frontend should make call to it's own API (micro service). However, your Shell app can provide some common/global library which can help the Micro Frontends make the AJAX call. But the onus of making the call must remain with the individual micro frontend.

user_42911760

From your question it is unclear if your apps are running in iframes, or are being loaded directly into your page.

In the case of iFrames your using postMessage and you can check the origin on received message via event.origin. Compare this with a list of allowed domains.

If your micro apps are directly on your page then you just control what is allowed to load into them.

user_20870700

So, in most microfrontends, each microapp does its own API calls to the corresponding microservice on the backend, and the shell app is ignorant of it. The most the shell app would do relative to this is passing some app config to all microapps which has config like the hostname of the various backends, and, an auth token if all the backends are using the same auth.

But to ensure the shell app doesn't have, say, an advertisement with malicious code trying to pose as another microapp, well..

  1. how are the microapps talking to the shell? Is there a common custom event? The name of the customEvent would have to be known to the intruder, but that's only security-by-obscurity, which isn't real.

  2. other methods like postMessage are between window objects, which I don't think help your case.

You might be able to re-use the authToken that the shell and microapps both know, since it was communicated at startup. But if you have microapps that come and go that won't work either.

user_35382580
Related