Real World JavaScript Security
summary
Real-world examples show concrete failures and fixes: an IoT Express app using cookie-parser accepts a cookie named constructor and bypasses authentication, a vulnerable merge-recursive deep merge enables prototype pollution via deep merge to set a global hasAnswer flag and flip logic, and lax request handling allows mass assignment to set isAdmin true in a Mongoose-style model. Demonstrations run and exploit code successfully; remediation includes hasOwnProperty checks, shallow copies/object spread, npm audit/npm audit fix and TrustedTypes/CSP.
AI-written summary · about
chapters (14)
- 0:00Start
- 0:12Introduction
- 6:18Known Bugs
- 12:40Common Mistakes
- 22:30Database Model
- 24:28Authentication Model
- 27:18Mass Assignment Attack
- 29:42Third-Party Components
- 30:10Npm Audit
- 30:54Npm Audit Fix
- 31:21Final Thoughts
- 31:31Code Reviews
- 31:54Measure and Track Your Code Quality in Security
- 33:45Breaking Your Ci Builds
