Securing Web Apps with Modern Platform Features
summary
Google recommends concrete defenses: deploy a nonce-based CSP (plus the CSP3 strict-dynamic keyword) to block injected scripts — Google reports rolling this out to ~200 apps and mitigating 20+ XSS in 12 months — and adopt trusted types to ban string assignments to dangerous DOM sinks. Add fetch-metadata headers to reject cross-site subresource requests and use cross-origin-opener-policy (and SameSite cookie testing) to sever attacker window references and reduce CSRF/side-channel risks.
AI-written summary · about
chapters (9)
- 0:00Intro
- 1:17Vulnerabilities
- 10:21Content security policy
- 13:23Nonspace CSP
- 20:57DOM XSS
- 27:31Summary
- 30:13Isolation Bypasses
- 33:30Fetch metadata request headers
- 37:42CrossOrigin Opener Policy
related talks
19mWeb Platform Security
47mD2T2 - Defense-in-Depth Techniques for Modern Web Apps
55mWeb Application Security: Browsers Fight Back!
59mThe Final Frontier: Security APIs in Modern Browsers
32mSecurity-First Web Apps
18mWriting an (in)secure webapp
48mSecurity Risk: Single-Page Applications.
24mTowards a post-XSS world.