Application security (AppSec) is a broad category that includes everything from secure coding practices to server-side vulnerability scanning and many subjects in between. Client-side security is a critical subset of AppSec that focuses specifically on protecting applications and their dependencies where they actually execute--in users' browsers. AppSec is protecting your entire application ecosystem, while client-side security protects the most critical layer--where your app meets your users. In today's JavaScript-heavy internet, most application logic actually runs client-side, making this the most important component of modern AppSec. Web Application Firewalls and most other AppSec tools do not monitor client-side activities at all, focusing on server-side code while ignoring the browser environment where most user interactions and data processing actually occur. AppSec covers where customers interact or input sensitive information, as well as where this information is stored and processed.
How do client-side attacks actually happen?
Compromising a third-party service your website relies on is one common way attackers get in.
Why can't traditional security tools detect client-side threats?
Firewalls, WAFs, and vulnerability scanners are traditional security tools used to protect your server, but they cannot see what's happening in your users' browsers.
What's the difference between client-side security and server-side security?
Server-side security protects your infrastructure, while client-side security focuses on where your application actually runs, inside your users' browsers.
What is client-side security, and why do I need it?
Protecting your website visitors from malicious JavaScript attacks that happen in their browsers is the goal of client-side security.