Web Platform Security
summary
Browsers still let injected scripts and forged requests act with a site’s credentials so fixes focus on privilege reduction. Google’s bug program pays mostly for XSS, and Chrome ships Content Security Policy tweaks: unsafe-dynamic nonces land in Chrome 52 to let audited scripts load their own vetted sub‑scripts; Subresource Integrity is already shipped in Chrome and Firefox to pin exact CDN bytes; a suborigins prototype experiments with sharding large hosts; SameSite cookie semantics and HSTS priming are proposed to cut CSRF and mixed‑content failures.
AI-written summary · about
chapters (5)
related talks
59mThe Final Frontier: Security APIs in Modern Browsers
41mSecuring Web Apps with Modern Platform Features
55mWeb Application Security: Browsers Fight Back!
51mWeb Platform: The Secure Parts
58mFixing XSS with Content Security Policy
24mWe're struggling to keep up
24mTowards a post-XSS world.
41mChrome Security Secret Sauce