Integrating scientific single-page applications with DevSecOps

Abstract

In the rapidly evolving field of frontend development, Single-Page Applications (SPAs) stand out for their ability to create dynamic and interactive web applications, particularly valuable in scientific software for their real-time data integration and complex workflow management. However, the process of creating a single-page web application development environment that accurately reflects the production environment isn’t always straightforward. Most SPA build systems assume configuration at build time, while DevSecOps engineers prefer runtime configuration. This paper proposes a unique, framework-agnostic methodology designed to bridge this divide, facilitating the seamless integration of SPAs within the DevSecOps framework without necessitating expertise in both domains. Leveraging environmental variables, Docker, and a strategic approach to Content Security Policy (CSP), we provide a comprehensive guide for developing, deploying, and securing SPAs in a manner that is both efficient and secure. Applying this method to the INTERSECT and Smart Spectral Matching platforms, we demonstrate its effectiveness in enhancing both the development process and the user experience in scientific applications, thereby addressing the complex challenges faced by research software engineers in the current landscape.