Web Application Security: Browsers Fight Back!
summary
Study shows nine out of ten web apps have vulnerabilities, so browsers add safeguards: built‑in XSS filters and HTTP headers. Demonstrations show CSP blocking inline scripts and styles (use hashes or CSP report-only for a dry run), HSTS with preload forces HTTPS, and HttpOnly+Secure cookies plus disabling TRACE reduce cookie theft. Clickjacking is shown via hidden iframes and is stopped by X-Frame-Options deny (quick win). Public key pinning and X-Content-Type-Options are covered, with practical advice on deployment tradeoffs.
AI-written summary · about
chapters (19)
- 0:00Start
- 6:23Impact of Cross-Site Scripting
- 8:41Microsoft Ie8
- 9:09Cross-Site Scripting Filter
- 10:43Webkit-Based Browsers
- 12:02Concert Security Policy
- 16:02Directives
- 20:54Way To Manage To Do Cross Site Scripting
- 22:47Constants
- 25:08Hash of the Inline Javascript Code
- 26:22A Violation of the Content Security Policy
- 27:42Report Uri
- 28:31Content Security Policy Report
- 35:07Hsts Http Strict Transport Security
- 38:13Update Insecure Requests
- 39:40Public Key Pinning
- 40:07Http Public Key Pinning
- 43:36Clickjacking
- 48:08X Frame Options
related talks
40mModern Web Application Defense with OWASP Tools
50mEnhancing Application Security: Understanding and Utilizing Browser Security Features
59mWeb Application Security Trends
19mWeb Platform Security
18mWriting an (in)secure webapp
37mFront-end Security
24mWe're struggling to keep up
24mTurn Your Browser into a Hacker Trap with HTTP Security Headers