Sandboxing micro frontends

We've already learned that security is not so easy to achieve with micro frontends. While the server side can be secured quite nicely—for instance, by requiring dedicated servers for each micro frontend—the client side presents the actual problem. If we let any micro frontend decide autonomously what goes in, we could have a security issue.

Another thing we already touched on is that micro frontends use native web technologies such as inline frames. An <iframe> element presents an elegant way of sandboxing parts of an application coming from other sources. On the other hand, we've noticed that inline frames also present real challenges. While some of these can be solved rather easily, others are a lot more difficult, or even impossible, to mitigate.

So, what options do we have to secure the frontend? Let's recap, as follows:

• Use inline frames with well-chosen sandbox attributes.
• Use server-side composition...