CORS, XSS, CSRF, SQL injection #BackToTheBasics

on YouTube ↗18m

" summary

Describes web security basics: CORS enforces origin+port+scheme and uses OPTIONS preflight with Access-Control headers, and misconfigured servers or tools like curl/proxies can bypass naive checks. Shows XSS caused by rendering URL parameters with React’s dangerouslySetInnerHTML and recommends Content-Security-Policy to restrict external scripts. Defines CSRF as forged requests mitigated by per-request tokens, and demonstrates SQL injection via a newsletter form, advocating use of prepared statements.

AI-written summary · about

" chapters (10)

1. 0:00Web security basics
2. 1:12Security in development
3. 2:58CORS mechanism
4. 4:49Optimizing CORS preflight
5. 7:59XSS risks
6. 10:16XSS with React
7. 12:28Preventing XSS with CSP
8. 13:37CSRF mechanism and risks
9. 15:31SQL injection risks
10. 17:19Preventing SQL injection

" related talks

• 19mFrontend Security is a ThingMadalina Cotumbeanu · DrupalCon Amsterdam 2019
• 07mWhat is an XSS attack - and why should you care?Carmen Chung · ReactConf AU 2020
• 59mWeb Application Security TrendsChristian Wentz · NDC Oslo 2018
• 18mWriting an (in)secure webappAdam Baldwin · JSConf US 2011
• 18mCross Site Scripting 101Niru Ragupathy · BSidesSF 2023
• 37mFront-end SecurityNykolai Belychuk · OdessaJS 2015
• 21mSecurity with HTTP headers: overview of attacks and defensesMathieu Humbert · Sunny Tech 2022
• 24mSecuring your site like it's 1999Katie Fenn · JSConf EU 2018