Introduction to Web Security
summary
A demo site uses Twilio and JWT auth and demonstrates concrete failures: JWT "none" exploit lets anyone flip a role when algs aren’t whitelisted; marked data‑URI XSS shows encoded entities that bypass sanitizers; service‑worker via JSONP callback installs a network‑level replaceer when callbacks aren’t validated; a strict CSP report‑uri stops those injected scripts. Fixes shown include HTTP‑Only cookies, _csrf tokens, rel="noopener noreferrer", whitelisted JWT algs, helmet headers, and keeping deps current with greenkeeper NSP and sneak.
AI-written summary · about
chapters (6)
- 0:00Start
- 27:06USE SIGNED HttpOnly COOKIES
- 27:22USE CSRF TOKENS
- 27:33BE AWARE OF ENCODING
- 27:44BE CAREFUL WITH JSONP
- 27:55USE CSP AS A SAFETY NET
