Client-Side Attacks are attacks that target the user’s side of a web application – the code, scripts, and processes that run in the user’s browser or device – rather than the organization’s backend servers. In modern web applications, a great deal of functionality executes on the client: JavaScript, third-party scripts, and dynamic content all run in the browser. This client environment, and the many external scripts loaded into it, form an attack surface that server-side defenses do not directly protect.
A defining characteristic is that these attacks often occur in the user’s browser, sometimes without ever touching or alerting the backend. This makes them hard to detect server-side, because the malicious activity happens on the client. Common client-side attacks include Cross-Site Scripting (XSS), where an attacker injects malicious scripts that execute in victims’ browsers to steal data, hijack sessions, or manipulate the page; and supply-chain style attacks such as Magecart, where attackers compromise a third-party script (for example, an analytics or payment library) so that it skims sensitive data – like payment card details entered on a checkout page – directly from users’ browsers.
The risk is amplified by heavy reliance on third-party JavaScript. A typical website loads scripts from many external providers, and a compromise of any one of them can inject malicious code into every visitor’s session. Because organizations often have limited visibility into what these third-party scripts do at runtime, a poisoned script can operate for a long time undetected. Other client-side threats include clickjacking, formjacking, and manipulation of client-side logic or stored data.
Consequences include theft of credentials and payment data, session hijacking, defacement, and fraud – frequently affecting large numbers of users at once. Defenses focus on controlling and monitoring what runs in the browser: Content Security Policy (CSP), Subresource Integrity (SRI) to verify third-party scripts have not been tampered with, careful vetting and least-privilege loading of external scripts, input/output encoding to prevent XSS, and client-side monitoring that watches for unexpected script behavior. Because client-side attacks exploit the trust placed in browser-executed and third-party code, protecting the client environment is a distinct and necessary complement to server-side security.