#Securing a Flutter-web app with Appwrite

5 messages · Page 1 of 1 (latest)

green hazel
#

Hey there, fellow Appwriters! I am developping a Flutter-web app with Appwrite to manage Auth, Database and Storage. I am quite new to web development so some of my questions might seem obvious.

I would like to secure my app against some well known security issues like XSS, CSRF, SQL/NoSQL injections. I am not well aware of what Flutter natively protects and what Appwrite natively protects.

  • XSS : I am using TextFields and TextFormFields for forms. Should I add some text sanitizing to prevent script injection? I have tried to put some script (<script>window.alert("hey!")</script>) in my fields but it was not executed by the browser. I have even created an entity in the app with that script as name. The special chars were not deleted but no script was executed either. The name was displayed in a Text widget and I think it prevents script to be executed from the server-client side.

  • CSRF : Users only access the app from the client side for authentication, database access (read/write) and file storage. Should I add custom tokens like JWT or is everything secured through Client sdk and permissions?

  • SQL/NoSQL injections : I may be wrong, but I think that Appwrite uses a collections/documents database system like NoSQL on top of some MariaDB. So data is stored like NoSQL as collections but with strong types for attributes. I am not very familiar with the concept of NoSQL injection, but I have seen it through researches. Are there some protections on the Appwrite side against NoSQL (or SQL) injections or should I set prepared statements before requesting the Appwrite database?

That's a lot I admit, but if anyone has answers it would be greatly appreciated!

digital valley
#

I'm neither an expert on Flutter Web nor security but you probably needn't worry about any of these issues.

SQL injections: Appwrite handles all DB stuffs and I'm pretty sure they use prepared statements. Also, you have no way of creating prepared statements in your Flutter app. You only need to worry about this if you're writing the backend yourself.

Check out this article may help clarify a few things.
https://dev.to/carminezacc/securely-storing-jwts-in-flutter-web-apps-2nal

PS: Appwrite uses cookies for authentication on the web

DEV Community
Securely Storing JWTs in (Flutter) Web Apps

I recently wrote a post about how to implement JWT Authorization in Flutter apps. I only considered t...

green hazel
#

Thanks for your answer! I will check your links!
I am also opened for any further advices

green hazel
#

Hey, can any Appwrite member confirm? I am especially looking for the existence of prepared statements inside the Database access code. All I can see for the moment concerning NoSQL injection is the replaceAll method that is useful but not the best protection.

sage harness