How to Protect Yourself Against XSS Attacks in Java

on YouTube ↗31m

" summary

A demo of persistent XSS in Java shows stealing JSESSIONID to take over sessions; XSS is the second-most common web vulnerability (~12.5% of incidents). Recommended defenses are context-aware escaping (different for HTML, JavaScript, CSS), server-side validation with allow-listing rather than blacklists, sanitizing rich HTML into a safe DOM, and keeping framework-specific issues and security patches (JSP/JSF, GWT, Struts, Wicket, Spring) under control.

AI-written summary · about

" chapters (11)

1. 0:00XSS introduction
2. 3:16What is XSS
3. 5:29XSS attack demo
4. 8:02XSS impact and scale
5. 10:11Why data filtering fails
6. 13:26Output escaping best defense
7. 17:02Secure coding principles
8. 22:48Frameworks for XSS protection
9. 26:45Web tech security
10. 29:20Framework vulnerabilities and XSS sources
11. 30:49Summary and Q&A

" related talks

• 52mSecure Authentication and Session Management in Java EEPatrycja Wegrzynowicz · Voxxed Days Bucharest 2016
• 33mJEE Frameworks vs Cross-Site Scripting (XSS)P. Bucki · 4Developers 2015
• 52mDemystifying Front-End SecurityIlya Verbitskiy · NDC Sydney 2020
• 52mSecure Authentication and Session Management in Java EEPatrycja Wegrzynowicz · Voxxed Days Vienna 2016
• 57mThe Last XSS Defense TalkJim Manico · NDC Porto 2022
• 50mSecure Authentication and Session ManagementPatrycja Wegrzynowicz · JavaDay Kyiv 2015
• 34mJS Security - A Pentesters PerspectivePrasanna Kanagasabei · JSConf.Asia 2015
• 59mWeb Application Security TrendsChristian Wentz · NDC Oslo 2018