D2T2 - Defense-in-Depth Techniques for Modern Web Apps
summary
Describes concrete defenses and rollout results: nonce and strict-dynamic CSPs deployed to protect against XSS (CSP enforced on over 50% of Google text/html traffic), a CSP Evaluator tool, and a plan to remove unsafe-eval; proposes new CSP features like unsafe-hashed-attributes to hash inline event handlers. Covers Subresource Integrity, SameSite cookies, Site Isolation + COOP/COEP/Corp to blunt Spectre/Meltdown, and a Suboriginator prototype for testing Suborigins and Origin Policy adoption.
AI-written summary · about
chapters (10)
- 0:00Introduction to defense in depth
- 1:14Content Security Policy overview
- 6:32Nonce-based CSP for XSS mitigation
- 10:10Strict dynamic CSP deployment
- 13:27CSP security levels at Google
- 23:28Subresource Integrity explained
- 26:40SameSite cookies for CSRF protection
- 29:15Site Isolation and CORP
- 33:57Upcoming sub origins and origin policy
- 46:13Q&A and closing remarks
related talks
41mSecuring Web Apps with Modern Platform Features
40mContent Security Policy to the Rescue
57mThe Last XSS Defense Talk
41mThe Last XSS Defense Talk: Why XSS Defense has radically changed in the past 7 years
40mModern Web Application Defense with OWASP Tools
01h 00mContent Security Policy: From newbie to advanced
53mI Wanna Deploy You, but My Senses Tell Me to ...
37mFront-end Security