Hacking your Front-End Apps
summary
Content injection proves the most common failure mode and simple sanitizers fail against whitespace obfuscation and inline handlers, so the practical fix is lock down by default: Content Security Policy forbids inline JS/CSS and eval, blocks cross‑domain scripts and iframes, and reports violations; Subresource Integrity pins CDN assets to stop tampered jQuery. Historical surprises underscore risk: a MySpace worm reaches 1.7 million friends, “Don’t Mess with Texas” yields a 72% reduction in litter, and evercookie survives ordinary clears. Also note JSONP loads remote script tags and requestAnimationFrame enables timing leaks, so pair CSP/SRI with HTTPS/HSTS, CORS, helmet or framework plugins.
AI-written summary · about
chapters (6)
- 0:00ALEX SEXTON HACKING YOUR FRONT-END APPS
- 5:11Keep Texas Beautiful
- 7:05DON'T MESS WITH XSS
- 15:40You cannot detect malicious code.
- 18:23Timing Attacks
- 25:13Content Security Policy
related talks
25mPracticing Safe Script
52mDemystifying Front-End Security
59mWeb Application Security Trends
23mJavaScript attack surface
08mHack Proofing Your JavaScript A Fun And Engaging Guide To Enhancing Security
40mHostile JavaScript: Attacking and Defending the Browser
27mBeyond the Basics: Securing JavaScript Applications
58mPractical Secure Development and Operations with JavaScript in 2020