We're struggling to keep up
summary
Claims that XSS has been the dominant web vulnerability since about 2007 and that same-origin checks are inconsistently implemented drive the talk, with concrete examples like Internet Explorer ignoring ports and XSS filters changing page parsing. It demonstrates practical defenses: HTTP Strict Transport Security and the failed initial HSTS preload list process, frame-based attacks and mitigations using iframe Sandbox, low real-world uptake of Content Security Policy, and the promise of Subresource Integrity to lock down third-party scripts.
AI-written summary · about
chapters (11)
- 0:00Intro
- 1:00Web Browser
- 4:30HTTPS
- 9:46Strict Transport
- 12:50Thread Model
- 13:36Meta Tags
- 14:24Crosssite scripting filters
- 15:35disallowframing
- 18:33Crosssite scripting
- 19:57Content delivery networks
- 22:03Conclusion
related talks
47mXSS is dead. We just don't get it.
41mThe Last XSS Defense Talk: Why XSS Defense has radically changed in the past 7 years
52mDemystifying Front-End Security
37mFront-end Security
57mThe Last XSS Defense Talk
55mWeb Application Security: Browsers Fight Back!
32mJavaScript security: a retrospective
43mNo Excuses Anymore: The Demise of Cross Site Scripting