clojure.web/with-security
summary
Clojure web apps lack a few concrete pieces: adopt crypto-password with HMAC and migration for password storage (bcrypt/scrypt/pbkdf2 plus HMAC), standardize auth on friend as the glue, and add a persistent session store behind Ring to prevent replay attacks. Use ring-antiforgery for CSRF, pick one template engine and add whitelist HTML sanitization to stop XSS, and build a small, opinionated crypto wrapper over JCA/BouncyCastle plus response headers (CSP, HSTS, X-Frame-Options) as defaults.
AI-written summary · about
chapters (9)
- 0:00Start
- 3:58What we are going to cover
- 5:36What do we have?
- 5:57crypto-password
- 7:52lib-noir
- 10:04ring
- 12:33friend
- 16:42Lets just talk about the problem
- 26:03What am I talking about?
