2025 - Jayton Birch

## Overview Jaden Burch challenges the widespread misconception that front-end validation and sanitization is merely a "nice to have" feature. He argues that front-end security is a separate, equally critical attack surface independent of back-end defenses and that enterprises must audit and harden both independently.

## Key Topics The talk addresses how modern front-end technologies are expanding attack surfaces. While traditional OWASP Top 10 vulnerabilities (2021) like injection attacks remain prevalent and often front-end-focused, new paradigms are emerging: server-side rendering, React server components, Chrome extensions, IndexedDB storage, and AI-enabled browser agents. The focus centers on React server components—now the default pattern in frameworks like Next.js—which represent a fundamental shift in how code is distributed between server and client.

## Technical Details

**URL Parameter Persistence**: Burch demonstrates a "memories" web app where a cross-site scripting payload is stored in URL parameters. Even if the back-end removes the malicious URL from database storage, the payload persists in browser state (session storage, memory, or URL params) and can be sent to victims without back-end involvement. He notes this exploit pattern appears hundreds of times in bug bounty disclosures filtered for "cross-site scripting" + "reflected" + "URI/URL."

**React Server Components Risks**: The framework automatically determines at build time whether components run server-side or client-side. While this streamlines development, it can accidentally expose server secrets (API keys, session tokens, credentials) to the client. More significantly, server functions automatically generate API endpoints identified by hashes—these endpoints appear in minified client-side code but bypass traditional security review processes. Historically, API endpoints required deliberate specification, committee approval, and security sign-off; React server components automate this with no such controls, creating endpoints developers may not realize they've created.

## Takeaways - Front-end and back-end security are two separate attack surfaces; the "conveyor belt" model of hoping someone catches attacks is fundamentally flawed. - Front-end validation is essential, not optional, because payloads can remain in browser state independently of back-end security. - Modern frameworks like Next.js with React server components introduce new risks through auto-generated endpoints and potential secret exposure. - Enterprises should maintain separate security checklists for front-end and back-end; both require dedicated audit and hardening. - Security professionals should understand new paradigms like React server components at a high level to effectively secure their organizations.