Securing Module Federation Remotes
Learn how to protect the remote-loading mechanism itself, preventing attackers from injecting or tampering with federated code at run time.
Securing Module Federation Remotes is a free Micro Frontends Architecture with Module Federation lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Micro Frontends Architecture with Module Federation learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Remotes Are Live Code
Module Federation fetches and executes remote JavaScript at run time. That power is also a risk: if an attacker controls a remote URL, they can run code inside your app.
The Threat: Remote Tampering
Key threats to the federation layer include:
- A compromised remote host serving malicious code
- Man-in-the-middle modification of
remoteEntry.js - Loading a remote from an unexpected origin
Always Serve Over HTTPS
Loading any remote over plain HTTP allows in-transit tampering. Every remoteEntry.js and chunk must be served over HTTPS, with HSTS enforced.
Allowlist Remote Origins
Do not load remotes from arbitrary URLs. Restrict allowed origins with a Content Security Policy so only trusted hosts can supply scripts.
Content-Security-Policy: script-src 'self' https://cdn.trusted.comSubresource Integrity (SRI)
SRI lets the browser verify a fetched script matches a known hash, rejecting it if it was altered. Pairing SRI with federation guards against tampered remotes.
<script src="/cart/remoteEntry.js"
integrity="sha384-..." crossorigin="anonymous">Validate the Remote Manifest
If you load remote URLs from a manifest, that manifest is a high-value target. Serve it from a trusted origin and validate its contents before using any URL.
Avoid Dynamic Untrusted URLs
Never build a remote URL from user input or untrusted config. An attacker who influences the URL can point your app at malicious code.
// dangerous:
import(userProvidedUrl);
// safe: import from a fixed allowlisted nameIsolate Remotes Where Possible
Because remotes share the same page context, a malicious remote can read the DOM and globals. For untrusted third-party MFEs, consider iframe or sandbox isolation.
Protect Shared State and Tokens
A compromised remote can read shared stores and globals. Never place raw auth tokens on window or in shared state where any remote could harvest them.
Verify Integrity in CI/CD
Generate and pin SRI hashes during the build, and check that deployed remoteEntry files match expected hashes, so a tampered artifact fails verification before users hit it.
Defense in Depth
No single control is enough. Combine HTTPS, CSP allowlists, SRI, manifest validation, and isolation so that bypassing one layer still leaves others protecting the app.
Quick Check
Test your federation-security knowledge.
Recap
You learned to secure federation remotes:
- Remotes execute live code, so the loader is an attack surface
- Always use HTTPS and a CSP script-src allowlist
- Verify integrity with SRI and hash checks in CI
- Never load remotes from untrusted URLs
- Isolate untrusted MFEs and protect tokens
Defense in depth keeps federated code trustworthy.
Frequently asked questions
Is the “Securing Module Federation Remotes” lesson free?
Yes — the full text of “Securing Module Federation Remotes” is free to read here on the web, and the Micro Frontends Architecture with Module Federation course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Micro Frontends Architecture with Module Federation course, upgrade to CoddyKit PRO.
What will I learn in “Securing Module Federation Remotes”?
Learn how to protect the remote-loading mechanism itself, preventing attackers from injecting or tampering with federated code at run time. You practise Micro Frontends Architecture with Module Federation with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Micro Frontends Architecture with Module Federation?
No prior experience is required. Micro Frontends Architecture with Module Federation on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Securing Module Federation Remotes” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Micro Frontends Architecture with Module Federation lesson?
Yes. Every Micro Frontends Architecture with Module Federation lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Authentication & Authorization
- Cross-Application Security Risks
- Best Practices for Secure Federation
- Securing Module Federation Remotes