Custom Apps: Unleash Amazing Potential

Enhanced & Tailored Security

In an era where data breaches are headline news, security cannot be an afterthought. It must be a foundational pillar of your technology strategy. Off-the-shelf apps, especially popular ones, can become large targets for malicious actors. A vulnerability discovered in a widely used software platform can instantly expose thousands of businesses to risk. While reputable vendors work hard to patch these issues, you are still reliant on their timeline and processes.

Custom apps offer a fundamentally more secure posture for several reasons:

• Obscurity: Because a custom app has a unique codebase, it’s not a target for large-scale, automated attacks looking for common vulnerabilities found in popular off-the-shelf software. Hackers can’t use a pre-written script to attack your app.

• Tailored Security Measures: We can build security protocols directly into the custom app that are specific to your business needs and risk profile. This could include complex multi-factor authentication workflows, role-based access controls that mirror your company’s hierarchy, and detailed audit logs that track every action taken within the platform.

• Compliance by Design: For businesses in regulated industries like healthcare (requiring HIPAA compliance) or finance, a custom app can be built from the ground up to meet every specific security and data privacy requirement. Trying to configure a generic platform to meet these stringent standards can be difficult and risky. With custom apps, compliance is a core part of the design.

• Full Control: You have complete control and visibility over your application’s security. You decide when security patches are applied and can conduct your own independent security audits at any time.

Building a custom app with a partner like StraStan, who prioritizes secure development practices, means you are investing in a digital asset with a hardened, defensible security posture designed specifically for you. Many of our blog post topics touch upon the importance of security in modern apps.

Technical Deep Dive: Securing Our Custom Content App

Security must be woven into the fabric of our custom dashboard for the Contentful Web App. Let’s consider how we would secure this custom app.

First, all communication between the user’s browser and our custom server, and between our server and the Contentful Web App API, must be encrypted using HTTPS. This is a baseline requirement for all modern apps.

Next, we focus on access control. As discussed, the organization id is our first line of defense for multi-tenancy. When a user authenticates, our custom app server provides them with a secure token (like a JWT) that contains their user ID, role, and organization id. Every subsequent request to our server must include this token.

Let’s look at a code example. The following code is a simplified representation of a server-side middleware that would check this token on every incoming request:

// Example middleware to check authentication and organization id
function authenticateRequest(req, res, next) {
  const token = req.headers.authorization;
  if (!token) {
    return res.status(401).send('Access Denied: No token provided.');
  }

  try {
    // The verify function would check the token's signature
    // and return the decoded payload, which includes the organization id
    const decoded = jwt.verify(token, process.env.JWT_SECRET);
    req.user = decoded; // Attach user info to the request
    next(); // Proceed to the actual request handler
  } catch (ex) {
    res.status(400).send('Invalid Token.');
  }
}

This following code ensures that no unauthenticated user can access the app’s resources. When the app needs to fetch content, the following code in the request handler would then use the req.user.organizationId to filter the results from the Contentful Web App.

Another critical security area is input validation, especially for forms. Every piece of data submitted through forms in our custom app (like the “Create New Blog Post” form) must be sanitized on the server to prevent attacks like Cross-Site Scripting (XSS) or SQL injection.

Finally, we would use a JSON configuration file to manage sensitive information like API keys, database credentials, and JWT secrets. This JSON configuration file is kept outside of the main codebase and is not checked into version control, preventing secrets from being accidentally exposed. This practice is crucial for the security of all custom apps. The sidebar itself would only render links to which the user has legitimate access.