Demystifying web application security
summary
Argues for replacing a laundry‑list of OWASP bugs with a trust‑first methodology that treats client input as untrusted, enforces role‑based authorization, and evaluates transmission, storage, credentials, libraries and logs case by case. Recommends HTTPS or secure WebSockets, use vetted crypto libraries (don’t reinvent RSA), run NPM audit and rotate credentials, update deps frequently. Describes building a custom audit system at ReStok that records DB mutations and flags anomalies — immutable audit logs.
AI-written summary · about
chapters (13)
- 0:00Start
- 2:41About Me
- 4:06Web 1.0
- 6:02Framework Developers!
- 8:07The real threat!
- 8:34Possible security exploits
- 14:39Let's talk about trust
- 15:02Thinking about trust
- 16:13Securing Identity in Web Apps
- 19:13Securing data in web apps
- 21:06Cryptography
- 21:40Credentials
- 24:35Your cheatsheet
related talks
34mWeb security explored through horror movies
01h 03mTen Key Steps for Enhanced Web App Security
32mSecurity-First Web Apps
30mWeb Security Engineering - Protect all layers of your project
59mPractical Security for Web Applications
38mPrioritizing Trust While Creating Applications
51m10 things developers need to know about web application security
52mPractical Security in Web Applications