Practical Secure Development and Operations with JavaScript in 2020
summary
Panel argues concrete fixes: client bugs are mostly XSS or CSRF, use framework escaping and CSRF middleware; npm packages can execute at install so harden supply chain with npm audit Snyk and try Lavamoat to diff capability changes; prefer tagged template literals for safe SQL to eliminate injection; note real-world surprises like high-severity reports for ACORN that are performance not security; experiment with Moddable JS on microcontrollers and propose compartments and module federation for sandboxing third‑party code and reducing privileged surface.
AI-written summary · about
chapters (13)
- 0:00Introduction and speakers
- 1:49Secure code development focus
- 7:15Server-side security challenges
- 12:30Third-party JavaScript risks
- 18:55Access control and data exposure
- 23:14Security in startup growth
- 27:07Embedded JavaScript security
- 33:51Standardization in security
- 37:02IoT device vulnerabilities
- 44:10Service workers and security
- 47:26SQL query building safety
- 49:53Dependency management risks
- 57:02Closing remarks
related talks
52mBest Practices for Developers to Master Security
38mThe Security Toolbox For Node
32mWriting Secure JavaScript Code
27mBeyond the Basics: Securing JavaScript Applications
08mHack Proofing Your JavaScript A Fun And Engaging Guide To Enhancing Security
19mCritical Security Mistakes in Frontend Applications
15m“Security” in the JavaScript ecosystem
34mReal World JavaScript Security