Evaluating Security for JavaScript-based Frontend Frameworks

This thesis systematically evaluates the security features of three popular JavaScript-based frontend frameworks—React, Vue, and Svelte—through the lens of the OWASP Top 10 vulnerabilities. This research identifies inherent security features, vulnerabilities, and mitigation strategies by developing a minimal webshop application with each framework and conducting extensive security testing using tools like OWASP ZAP, Semgrep, and Dependency-Check. Comparative analysis reveals disparities in how these frameworks address key security threats, providing insights into their out-of-the-box security capabilities, reliance on third-party modules, and effectiveness in mitigating risks. Findings suggest that while all frameworks possess strengths and weaknesses, React demonstrates higher mitigation levels, Vue includes the most secure base configuration, featuring no vulnerable underlying packages or components, and Svelte achieves minimal code complexity with moderate security coverage. The research brings attention to the importance of layered security testing and offers actionable recommendations for developers to enhance the security of their applications.