XSS, CSRF, CSP, JWT, Wtf? Idk ¯\_(ツ)_/¯

on YouTube ↗31m

" summary

Demonstrates concrete web security attacks and mitigations: a JWT "none" algorithm exploit that converts a user cookie to admin (fixed by using HttpOnly cookies and whitelisting algorithms); a CSRF reproduction via a cross-site form post mitigated with a CSRF token sent in a cookie and header; and a marked-markdown XSS bypass using encoded-colon tricks that requires patching the library. Also shows a JSONP callback attack that can install a malicious service worker, and how a Content Security Policy (report-only then enforcing), combined with dependency updates, can block many of these issues.

AI-written summary · about

" chapters (10)

1. 0:00Intro
2. 1:00Who am I
3. 2:35HTTPS
4. 8:51Social Networks
5. 9:45Cross-Site Request Forgery
6. 10:56Targetblank links
7. 14:24Myspace worm
8. 17:23XSS
9. 19:49Bottom Line
10. 24:43CSP

" related talks

• 28mXSS, CSRF, CSP, JWT, Wtf? IdkDominik Kundel · JSConf Iceland 2018
• 29mIntroduction to Web SecurityDominik Kundel · JSUnconf 2018
• 41mWeb SecurityStepan Suvorov · DevDays Europe 2019
• 33mHacking The Front-EndAlex Sexton · Full Stack Fest 2015
• 34mJS Security - A Pentesters PerspectivePrasanna Kanagasabei · JSConf.Asia 2015
• 28mOffensive and Defensive Strategies for Client-Side JS SecurityAnand Vemuri · JSConf Budapest 2016
• 23mJavaScript attack surfaceDavit Karapetyan · JavaScript Summit Armenia 2023
• 22mYou use Content Security Policy, don't you?Kacper Sokołowski · JSConf Budapest 2017