~/talk

Web Security

on YouTube 41m
Talkat DevDays Europe 2019 · 2019-05-14..05-16· [security, web-platform]

speaker

name:Stepan Suvorov
website:https://angular.ninja

resources

video:https://youtu.be/X72rILrTWjs
slides:none on file

summary

Covers concrete fixes and failures: demonstrates that JWT is only base64 not encrypted, shows Angular pitfalls like bypassSecurityTrust and recommends beef for live XSS proofs, cites a Modernizr CDN compromise that exfiltrated credit cards affecting ~60,000 users, warns about malicious npm forks (one copy still gets ~56 downloads/week), and prescribes practical defenses — CSP, subresource integrity, SameSite cookies and HSTS, plus Let's Encrypt for HTTPS.

AI-written summary · about

chapters (12)

  1. 0:00Intro
  2. 0:48Thank you for the inspiration!
  3. 3:383 Properties of Session-Management
  4. 11:37Reflected XSS
  5. 16:15Angular against XSS
  6. 22:39What to do against CSRF
  7. 27:01Subresource Integrity
  8. 28:52True story
  9. 32:28What does CSP do?
  10. 33:14Report Only Mode
  11. 34:36SSL vs TLS
  12. 36:51Redirect

related talks

~/search
type to search 6,249 conferences, 138,987 speakers and 185,172 talks
~/help
cmdctrl k
search every conference, speaker and series
/
focus the filter search
h
home
c
conferences
s
speakers
e
series
t
light / dark — the status bar button does the same
?
this help
esc
close this, then clear every filter — or just the search, while you are typing in it

Ignored while you are typing. Pages without a filter rail have no search to focus.