Web application security for developers. Nanne Baars. Java Fest 2020 Online
summary
Covers 10 topics with concrete failures and fixes: leaking credentials checked into GitHub that expose databases and let attackers clone repos, a recommended quick mitigation using git-secret encryption for configs and committing only ciphertext, and adding repository scanners into CI (eg GitLeaks style) to prevent reintroducing secrets. Demonstrates path traversal in file uploads that allows ../ overwrite of system files, shows ECB encryption leaking image blocks, and describes a real host header account reset attack and the Spring header validation option that blocks it.
AI-written summary · about
chapters (8)
- 0:00Inleiding tot webapplicatiebeveiliging
- 9:05Rol van ontwikkelaars in applicatiebeveiliging
- 17:14Cryptography and safe implementation
- 29:58Header-injecties en host-header manipulatie
- 35:38OAuth and external auth providers
- 44:06Beveiligingsrichtlijnen en automatische scanning
- 49:23Tools and resources for developers
- 50:48Afsluiting en vragen
related talks
51m10 things developers need to know about web application security
46mLive hacking: Breaking into your Java web app
49mDon't Get Burned: Secure Coding Essentials in Java to protect your application
52mThe Complete Guide to Secret Hygiene for Java and Cloud-Native Engineers
02h 38mJava application security the hard way - a workshop for the serious developer
01h 06mLive hacking: Breaking into your Java web app
43mLive hacking: Breaking into your Java web app
55mBreaking and Fixing Web Application Security