leo4135 Threat Modeling for JavaScript Apps
Workflow
- Identify assets — data, credentials, business logic, infrastructure
- Draw trust boundaries — browser ↔ CDN ↔ API ↔ DB ↔ third parties
- Enumerate entry points — routes, WebSockets, webhooks, file uploads, cron
- Apply STRIDE per component
- Prioritize threats — likelihood × impact
- Map mitigations — existing controls vs gaps
Trust Boundary Template
flowchart LR
User[User Browser]
CDN[CDN / Edge]
API[API Server]
DB[(Database)]
Ext[Third-Party APIs]
User -->|HTTPS| CDN
CDN -->|HTTPS| API
API -->|TLS| DB
API -->|HTTPS| Ext
Adapt to detected architecture (serverless, BFF, microservices, etc.).
STRIDE Reference
| Threat | Definition | JS/TS Examples |
|---|---|---|
| Spoofing | Pretending to be someone/something else | JWT forgery, session hijacking, SSRF via spoofed Host |
| Tampering | Modifying data or code | Parameter tampering, prototype pollution, MITM |
| Repudiation | Denying an action | Missing audit logs, unsigned webhooks |
| Information Disclosure | Exposing data to unauthorized parties | Verbose errors, .env in bundle, IDOR |
| Denial of Service | Disabling or degrading service | ReDoS, unbounded queries, event loop blocking |
| Elevation of Privilege | Gaining unauthorized capabilities | Missing RBAC, mass assignment, path traversal |
Threat Table Template
| ID | Component | Threat (STRIDE) | Scenario | Likelihood | Impact | Risk | Existing Controls | Gap / Mitigation |
|----|-----------|-----------------|----------|------------|--------|------|-------------------|------------------|
| T-01 | /api/users/:id | I — IDOR | Attacker changes ID to access other users' data | High | High | Critical | JWT auth | No object-level auth check |
| T-02 | File upload | E — Path traversal | Upload `../../etc/passwd` filename | Medium | High | High | Multer filter | No path canonicalization |
Attack Surface Checklist
Map each entry point:
| Entry Point | Auth Required? | Input Types | Data Accessed | Notes |
|---|---|---|---|---|
POST /api/login |
No | JSON body | User credentials | Rate limit? |
GET /api/users/:id |
Yes | URL param | User PII | IDOR risk |
WS /chat |
Yes | Messages | Chat history | XSS if rendered |
Webhook /hooks/stripe |
Signature | JSON body | Payment events | Verify signature |
Common JS/TS Threat Scenarios
Client-Side
- XSS via unsanitized user content → session theft
- Sensitive data in localStorage → XSS exfiltration
- postMessage without origin check → data leak
- Client-side auth checks only → API bypass
Server-Side (Node.js)
- Prototype pollution via
JSON.parse+ merge → RCE chain child_processwith user input → command injection- SSRF via
fetch(userUrl)→ internal network access - ReDoS in validation regex → DoS
Full-Stack Frameworks
- Next.js Server Actions without auth → unauthorized mutations
- API routes missing middleware → auth bypass
- Edge middleware bypass via direct API access
Supply Chain
- Compromised npm package → credential theft
- Typosquatting dependency → backdoor
Data Flow Diagram (DFD) Levels
Level 0 — Context:
[External User] → [Web Application] → [Database]
↓
[Payment Provider]
Level 1 — Decompose application:
[Browser] → [Frontend SPA] → [API Gateway] → [Auth Service]
↓
[Business Logic] → [DB]
↓
[Object Storage]
Prioritization Matrix
| Low Impact | High Impact | |
|---|---|---|
| High Likelihood | Medium | Critical |
| Low Likelihood | Low | High |
Output
Deliver:
- Trust boundary diagram (mermaid)
- Attack surface table
- STRIDE threat table with risk ratings
- Top 5 threats requiring immediate attention
- Recommended security controls per gap