Plants vs thieves: Automated Tests in the World of Security
summary
Shows concrete security checks implemented with Cypress e2e scripts: inject a <script>alert(1)</script> into inputs to detect XSS, visit crafted URLs to catch SQL injection, and fire API requests that expect 403 for CSRF on unauthorized actions. Demonstrates reading response headers and asserting the Content-Security-Policy header via API intercepts (requires Cypress experimental CSP config), notes Cypress blocks HTTP navigation, recommends combining unit/integration tests with SAST/DAST, Dependabot, OWASP Top 10 prioritization and nightly test schedules.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 1:26Security metaphor: Plants vs Zombies
- 3:33Testing matters for security
- 5:19Top web security risks
- 7:46Detecting injection attacks
- 10:38Testing CSRF and SQL injection
- 12:23Enforcing Content Security Policy
- 14:11Verifying access control
- 15:34Cryptographic failures in Cypress
- 16:41Complementing tests with tools
- 18:25Integrating security testing
- 20:55Key takeaways
- 22:20Q&A: Vulnerability prioritization
- 23:46Q&A: Incident feedback
- 25:12Q&A: Success stories
- 27:47Closing
related talks
55mPlants vs thieves: Automated Tests in the World of Web Security
23mGaining Confidence with Cypress Tests
35mCypress Tales: Effective E2E Testing
57mGaining Confidence with Cypress Tests
32mCypress.io – the State of the Art End-to-end Testing Tool
52mCypress: Testing without Selenium, Part 2
33mCypress: The future of E2E testing
56mCypress: Where Automated Acceptance Testing Isn’t Just for QA Anymore