Security-First Web Apps
summary
Argues that doing security up front saves work later and demonstrates concrete measures: set HSTS, X-Content-Type-Options and Permissions-Policy headers; run a CSP as an HTTP header with nonces and a report-only rollout to avoid breaking users; prefer token CSRF for strong protection though referer checks work for most; lock npm versions after the left-pad 11‑line incident and audit postinstall scripts (pnpm blocks them by default); ships a middleware called shield wall for Solid Start and Tense Stack Start that applies these headers and CSRF checks.
AI-written summary · about
chapters (13)
- 0:00Security-first apps intro
- 1:23Security needs redundancy
- 3:52HTTP security headers
- 7:28HSTS preload setup
- 8:31Content Security Policy deep dive
- 12:06CSP via HTTP header
- 13:53Nonces for XSS and MITM
- 15:20CSRF protection strategies
- 18:12Shield Wall middleware
- 24:18Supply chain attacks risks
- 26:47Preventing supply chain attacks
- 28:54GitHub Actions hardening
- 30:17Security best practices recap
related talks
13mSecurity in modern Web Applications - OWASP to the rescue
55mWeb Application Security: Browsers Fight Back!
18mWriting an (in)secure webapp
44mMicro Frontends and Security
26mHTTP Headers - The Simplest Security
59mHTTP Security Headers You Need To Have On Your Web Apps
48mSecurity Risk: Single-Page Applications.
25mSecurity First