Skip to content

OWASP SCS CDN and Front-End Supply Chain Security Handbook

Cover of CDN and Front-End Supply Chain Security
← All handbooks

Handbook 01 · 75 PDF pages

Defend dApp delivery across CDNs, dependencies, build pipelines, third-party scripts, and browser integrity controls.

Open PDF Download PDF

OWASP Smart Contract Security Project

Part of the OWASP SCS Handbook Series. Built to the series conventions.

Purpose and Scope

Threat models and defensive guidance for the content delivery network (CDN), front-end, and supply chain components of Web3 applications. The handbook is grounded in the controls that matter today: Subresource Integrity (SRI), Content Security Policy (CSP), Software Bill of Materials (SBOM), Supply-chain Levels for Software Artifacts (SLSA), and signing with Sigstore, set against real CDN and dependency compromises such as the Polyfill.io attack of June 2024, the Ledger Connect Kit incident of December 2023, and the npm and CI/CD attacks of 2024 and 2025. It covers dependency management, the build and deployment pipeline, content integrity, and third-party script and asset risk, with the regulatory context of U.S. Executive Order 14028 and the EU Cyber Resilience Act.

A dApp's smart contracts can be flawless while its users still lose funds, because the code a user actually runs is the JavaScript a CDN serves to their browser. That front end is the largest and least-audited attack surface in Web3. This handbook treats it as a first-class security boundary.

Target Audience

Front-end and full-stack developers, DevOps and platform engineers, and security practitioners responsible for dApp front ends and their delivery infrastructure.

How to Use This Handbook

Read Part I to fix the threat model and vocabulary. Parts II through IV are reference material organized by component: the CDN and content layer, the front-end supply chain, and per-component threat models. Part V is operational: checklists, monitoring, and incident response for a supply chain compromise. The appendices hold a glossary, reusable threat-model templates, and the consolidated bibliography. Engineers shipping a change tonight can jump to the checklists in Part V and the SRI and CSP sections in Part II.

Relationship to SCSVS, SCSTG, and SCWE

This handbook complements the OWASP smart contract standards rather than duplicating them. The Smart Contract Security Verification Standard (SCSVS) defines what a secure system must satisfy; the front-end controls here are the delivery-layer counterpart to its integrity requirements. The Smart Contract Security Testing Guide (SCSTG) describes how to test; the pipeline and dependency tests in Parts III and V extend that testing outward to the build system. The Smart Contract Weakness Enumeration (SCWE) catalogs contract weaknesses; the front-end and supply-chain weaknesses here fill the gap the enumeration leaves at the browser and build boundary. The companion Web3 Attack Vectors Mapping Handbook (10) places these risks in the broader WA01 to WA15 taxonomy, and the Incident Response Handbook (06) owns the response process this handbook feeds into.

Contents

Part I: Foundations

Part II: CDN and Content Delivery

Part III: Front-End Supply Chain

Part IV: Threat Models by Component

Part V: Mitigations and Operations

Part VI: Appendices