Simple AND Secure?
summary
Concrete checklist for securing a Clojure web app: use HTTPS (Let’s Encrypt), follow OWASP Top 10 (2017), and avoid GET for state changes; use ring-anti-forgery middleware for CSRF protection and bind tokens to sessions; prevent XSS by using templates that escape by default (e.g. hiccup 2.0.0-alpha1 or Selmer) and validate input; stop injection by escaping DB queries (use libraries like yesql); store passwords with buddy-hashers (salt + hash); ring defaults supply many useful headers and HSTS.
AI-written summary · about
chapters (25)
- 0:00Intro
- 1:27Clojure Ring
- 1:52Ring Requests & Responses
- 2:30Ring Middleware
- 3:31Routing with Compojure
- 3:55Putting it all together
- 4:54Where is the security?
- 5:56How to Write a Secure Web Application Maintain your application
- 7:34OWASP Top 10 2017
- 9:08XSS-Cross-site Scripting
- 10:52Validate Input - Escape Output
- 13:47CSRF. Cross-site Request Forgery
- 15:00Protect Against CSRF Don't use GET requests to change statel
- 16:49CSRF Protection
- 18:38Injection
- 19:42Parameterize Queries
- 19:58Authentication & Authorization How do I know if the user is who he says he is?
- 20:19Introducing Buddy
- 21:41Buddy-Auth
- 22:52Simple Auth Example
- 23:50Authorization with Buddy
- 25:21Auth Middleware
- 27:20HTTP Security Headers
- 29:56In Summary...
- 30:52Example Web Application: (WIP)
