TL;DR: PWA security
- Progressive Web Apps (PWAs) inherit the client-side security concerns of any website, plus a new attack surface: the service worker, which can intercept every network request from the client indefinitely.
- A compromised service worker can persist for weeks or months because browsers cache them aggressively, and can silently exfiltrate every subsequent user interaction.
- PWA security requires the same client-side monitoring approach as any modern site: inventory of scripts and workers, integrity verification, and in-session detection of tamper attempts.
Short on time? See cside's in-browser Magecart and skimmer blocking. It covers everything below in one deployment.
Progressive Web Apps (PWAs) have changed how we build and deliver applications, and it's easy to see why they caught on. They simplify development, combining the flexibility of the web with the capabilities of mobile. Features like offline access, push notifications, and hardware integration all come wrapped in the convenience of a browser. Updates like iOS 16.4 in 2023 made it easier to embed those browser capabilities into apps, and PWA adoption has grown since.
But there's a flipside. With their rise comes an increase in client-side security risks. And the industry? It's barely talked about.
PWAs are browsers
PWAs are browsers. They transform every app into a micro-web environment. That's their power: they load instantly, reuse website code, and connect to web services without friction. Yet, this very architecture also exposes them to the web's vulnerabilities, especially client-side risks tied to 3rd-party scripts.
Modern websites depend on these scripts for everything from analytics to engagement tools. While convenient, they massively expand your attack surface. In a PWA, these same scripts run directly in the app, which amplifies risks like data breaches and malicious injections.
Your risk isn't limited to website visitors anymore; it extends to every app user.
Keep the web supply chain in mind
The client-side is the final stop in the chain. It's where your code, both 1st and 3rd-party, loads into the user's browser or PWA.
3rd-party scripts sourced from external vendors are integral but often fall outside your control, which makes them prime targets for attackers. Compromised analytics scripts leak user data. Malicious code gets injected into chatbots. The client-side is under constant threat.
Building a PWA only amplifies these risks by bringing them into your app.
PWAs are not bad
That said, we don't advocate against using PWAs. Depending on your needs, they're likely the smartest choice. Just don't overlook the security challenges they bring. Unfortunately, client-side vulnerabilities, especially from 3rd-party scripts, are often ignored.
We've built cside, a 3rd-party script monitoring and security tool. This solves all these problems in both web and PWA environments. Install it right now, or talk to us. We're more than happy to help you get started.
