10 things developers need to know about web application security
summary
An open training app is available as a Docker image and the talk shows live scans that find exposed repos and S3 buckets leaking tokens and customer data, some used to mine bitcoins; a Stack Overflow copy‑paste led to SQL injection vulnerabilities in real projects. Demos include XXE allowing remote file reads and SSRF to internal services, JWT libraries that accept forged signatures or alg=none, and misconfigured CORS with Access-Control-Allow-Origin: that lets attackers steal cookies. Advice: fix parsers, validate tokens, salt+pepper passwords, and monitor login attempts.
AI-written summary · about
chapters (13)
- 0:00Welcome and introduction
- 2:36Why security matters now
- 5:06Security in development process
- 10:51SQL injection explained
- 17:36XML external entity attacks
- 22:15Authentication and tokens
- 29:01Token expiration and security
- 35:01Cookie security best practices
- 40:16Cross-site request forgery
- 43:09Password security fundamentals
- 46:42Hashing and brute force protection
- 48:28Database encryption strategies
- 49:54Monitoring login attempts
related talks
01h 03mTen Key Steps for Enhanced Web App Security
01h 30mCommon Webapp Vulnerabilities and What to Do About Them
59mPractical Security for Web Applications
30mWeb Security Engineering - Protect all layers of your project
41mLive Hacking: Breaking into Your Web App
55mBreaking and Fixing Web Application Security
36mDay Zero — How to Build a Web App and Avoid Headline News
02h 14mWeb application security (Part 1)