Safety not Guaranteed
summary
Covers real-world JavaScript client-side security issues in frameworks, libraries and apps, including attacks that exploit CDN-loaded resources, improper dynamic parsing, and third‑party widgets/extensions. Presents case studies and application-security testing examples showing how flaws let attackers bypass controls and steal crypto keys or protected data, and discusses certain server configuration mistakes that can break client-side security.
AI-written summary · about
chapters (15)
- 0:00Start
- 3:27Appsecco Security Clinic
- 6:56Attacker Setup
- 9:52Client Side Weaknesses
- 12:20AngularJS & (Expression) Template Injection
- 17:09Server Side Weaknesses
- 19:50Server Side Template Injection in Jade Pug
- 23:01Node.js unserialize() code execution
- 25:24Tell me your secret
- 29:43Typo & and a Clicklacking attack
- 31:48Script Injection due to a weak regex
- 37:49Content Security Policy
- 38:17How does a policy look like?
- 45:41Building Secure Stuff - Where to start?
- 47:45Appsecco Application Security Clinic
related talks
34mWarning Ahead: Security Storms are Brewing in Your JavaScript
58mPractical Secure Development and Operations with JavaScript in 2020
08mHack Proofing Your JavaScript A Fun And Engaging Guide To Enhancing Security
41mWeb Security
59mWeb Application Security Trends
42mThe Hitchhiker's Guide to Client-Side Security
48mSecure Development on the Frontend
19mFrontend Security is a Thing