Securing your site like it's 1999

on YouTube ↗24m

" summary

Early web anecdotes turn into concrete lessons: HTML and BBCode mismatches allow arbitrary markup and JavaScript, SQL injection lets attackers run queries so use parameterised queries or ORM not string concatenation, CSRF lets outsiders trigger state changes so use tokens and origin checks, and an automated MySpace worm generates 900,000 friend requests and collapses the site showing how exploits scale. Practical defenses listed include joi validation, sanitisation.html, CSP and integrity attributes, with examples of what worked and what failed.

AI-written summary · about

" chapters (8)

1. 0:00Intro
2. 2:47Bad Input Validation
3. 3:54Never Trust User Input
4. 7:13SQL Injection
5. 8:30Bonus Story
6. 15:30Crosssite scripting
7. 16:25JavaScript injection
8. 20:00How to protect yourself

" related talks

• 33mHacking The Front-EndAlex Sexton · Full Stack Fest 2015
• 01h 04mWeb Security And YouEli White · PHP UK Conference 2014
• 25mPracticing Safe ScriptAlex Sexton · dotJS 2013
• 59mWeb Application Security TrendsChristian Wentz · NDC Oslo 2018
• 17mA Beginners Guide to Security Exploits in ActionAshley Mathew, Mario de la Ossa · DjangoCon Europe 2023
• 18mWriting an (in)secure webappAdam Baldwin · JSConf US 2011
• 19mFrontend Security is a ThingMadalina Cotumbeanu · DrupalCon Amsterdam 2019
• 32mWeb Security for Newcomers: how to avoid getting hacked as a software developerAndreas Paech · PyConline AU 2021