JavaScript security: a retrospective

on YouTube ↗32m

" summary

Research-driven history compares language and DOM changes to concrete fixes and failures, shows demos that reproduce old exploits, and reports years when mitigations arrive: same-origin policy since 1995, Content-Type misinterpretation fixed in IE 2008, XSS filters 2010 then Content Security Policy, WebSockets 2011 blind spot. Automated scanners skip WebSocket paths, manual penetration tests find lingering vectors, and a real campaign served malware only to Google-referrer visitors, proving the retrospective ties feature growth to measurable vulnerability surface and patched timelines.

AI-written summary · about

" chapters (15)

1. 0:00Start
2. 0:53About me
3. 3:11Security fundamentals - CIA triad
4. 4:11Security fundamentals - Confidentiality
5. 4:32Security fundamentals - Integrity
6. 4:56Security fundamentals - Availability
7. 6:09JavaScript
8. 14:02ECMAScript
9. 19:03Content type misinterpretation
10. 20:32Clickjacking
11. 22:12Cross-site scripting
12. 25:25Solution - X-XSS-Protection
13. 26:08Solution-Content-Security-Policy
14. 26:38Referrer attacks
15. 27:20Conclusions

" related talks

• 23mJavaScript attack surfaceDavit Karapetyan · JavaScript Summit Armenia 2023
• 24mWe're struggling to keep upFrederik Braun · JSConf EU 2014
• 37mFront-end SecurityNykolai Belychuk · OdessaJS 2015
• 33mHacking The Front-EndAlex Sexton · Full Stack Fest 2015
• 36mHTML5 JS SecurityMaty Siman · AppSec California 2014
• 34mJS Security - A Pentesters PerspectivePrasanna Kanagasabei · JSConf.Asia 2015
• 59mThe Final Frontier: Security APIs in Modern BrowsersChristian Wenz · NDC Oslo 2024
• 35mHow the Web Tangled ItselfMartin Johns, Ben Stock, Marius Steffens, Michael Backes · 26th USENIX Security Symposium (USENIX Security '17)