Zoom Apps SDK

Security

Overview

Zoom Apps must meet security requirements for Marketplace approval. This covers required headers, CSP configuration, cookie security, and token storage.

Required OWASP Headers

Zoom's security review requires these HTTP headers on all responses:

Express Implementation

app.use((req, res, next) => {
  res.setHeader('Strict-Transport-Security', 'max-age=31536000');
  res.setHeader('X-Content-Type-Options', 'nosniff');
  res.setHeader('Content-Security-Policy',
    "frame-ancestors 'self' zoom.us *.zoom.us"
  );
  res.setHeader('Referrer-Policy', 'same-origin');
  next();
});

Critical: The frame-ancestors CSP directive is what allows Zoom's embedded browser to load your app. Without it, the browser blocks the frame.

TLS Requirements

• HTTPS required for all endpoints (minimum TLS 1.2)

• HTTP redirects to HTTPS

• Valid SSL certificate (self-signed will fail)

• ngrok provides HTTPS automatically for local development

Cookie Security

Zoom's embedded browser requires specific cookie settings:

// Express cookie-session example
app.use(require('cookie-session')({
  name: 'session',
  keys: [process.env.SESSION_SECRET],
  maxAge: 24 * 60 * 60 * 1000, // 24 hours
  sameSite: 'none',  // REQUIRED - Zoom embeds your app cross-origin
  secure: true       // REQUIRED - SameSite=None requires Secure
}));

Why SameSite=None? Your app runs inside Zoom's embedded browser, which is a different origin. Without SameSite=None, the browser won't send cookies to your server, and sessions break silently.

PKCE OAuth Security

All Zoom Apps OAuth flows should use PKCE (Proof Key for Code Exchange):

const crypto = require('crypto');

// Generate PKCE pair
const verifier = crypto.randomBytes(32).toString('hex');
const challenge = crypto.createHash('sha256')
  .update(verifier)
  .digest('base64url');

// Store verifier in session (server-side)
req.session.codeVerifier = verifier;

// Send challenge to frontend (or include in OAuth redirect URL)
res.json({ codeChallenge: challenge, state: req.session.state });

PKCE prevents authorization code interception attacks. The code_verifier never leaves your server.

Token Storage

Never store tokens in the frontend (localStorage, sessionStorage, cookies).

// Redis token storage example
const Redis = require('ioredis');
const redis = new Redis(process.env.REDIS_URL);

async function storeTokens(zoomUserId, tokens) {
  await redis.set(
    `zoom:tokens:${zoomUserId}`,
    JSON.stringify(tokens),
    'EX', tokens.expires_in // Auto-expire with token
  );
}

async function getTokens(zoomUserId) {
  const data = await redis.get(`zoom:tokens:${zoomUserId}`);
  return data ? JSON.parse(data) : null;
}

State Parameter (CSRF Protection)

Always validate the OAuth state parameter:

const crypto = require('crypto');

// Generate state before OAuth redirect
const state = crypto.randomBytes(16).toString('hex');
req.session.oauthState = state;

// Validate state on callback
app.get('/auth', (req, res) => {
  if (req.query.state !== req.session.oauthState) {
    return res.status(403).send('Invalid state - possible CSRF attack');
  }
  // Proceed with token exchange
});

Data Access Layers

Principle of least privilege: Only request the OAuth scopes and SDK capabilities you actually need.

Marketplace Security Review Checklist

• [ ] All OWASP headers set on every response

• [ ] HTTPS enforced (no HTTP endpoints)

• [ ] PKCE used for OAuth flows

• [ ] State parameter validated on OAuth callbacks

• [ ] Tokens stored server-side (never in frontend)

• [ ] Token refresh implemented (tokens expire in 1 hour)

• [ ] SameSite=None; Secure on cookies

• [ ] CSP allows frame-ancestors zoom.us *.zoom.us

• [ ] No sensitive data logged to console in production

• [ ] Environment variables for all secrets (no hardcoded credentials)

Resources

• Security docs: https://developers.zoom.us/docs/zoom-apps/security/

• OWASP headers: https://developers.zoom.us/docs/zoom-apps/security/owasp/