You use Content Security Policy, don't you?
summary
Demonstrates a live XSS exploit that steals session cookies and logs into the admin panel, then shows a fix: implement CSP header via Express middleware which blocks inline scripts and prevents that cookie theft, with browser reports sent to a reporting endpoint for auditing. Claims CSP can largely stop XSS when correctly scoped, notes a real surprising loss figure ($171 million for Sony), and warns of practical limits like Amazon S3 not setting CSP headers by default which required adding an edge layer.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 0:55Sony hack
- 1:47Frontend security
- 2:33Virus on MySpace
- 4:00Crosssite scripting
- 12:30HTTP only cookies
- 13:01Content Security Policy
- 17:51Content Security Policy downsides
related talks
32mWhat is CSP and Why Haven't You Applied it Yet
24mTowards a post-XSS world.
58mFixing XSS with Content Security Policy
17mContent Security Policy: The application security Swiss Army Knife
01h 04mCSP XXP STS PKP CAA ETC OMG WTF BBQ…
31mXSS, CSRF, CSP, JWT, Wtf? Idk ¯\_(ツ)_/¯
40mContent Security Policy to the Rescue
46mContent Security Policies: Let's Break Stuff