The Final Frontier: Security APIs in Modern Browsers

on YouTube ↗59m

" summary

Demo web app shows how Content-Security-Policy blocks inline scripts and styles, forces use of nonces or hashes to re-enable legacy inline code, and surfaces violations via report-uri; a setInterval string triggers unsafe-eval problems until code is refactored or nonces/hashes are applied. Chromium-only Trusted Types plus DOMPurify sanitization is used to safely assign innerHTML. Subresource Integrity with sha512 and sha384 for CDN scripts, HTTPOnly/Secure/SameSite cookies, HSTS preload and Clear-Site-Data are shown working; XSS CVEs run near 6,000 this year.

AI-written summary · about

" chapters (13)

1. 0:00Introduction to browser security
2. 1:36Understanding XSS and SOP
3. 5:19Content security policy basics
4. 10:14Implementing CSP in web apps
5. 13:32Solving CSP inline code issues
6. 18:01CSP for legacy systems
7. 22:47CSP reporting and monitoring
8. 28:40Trusted types and subresource integrity
9. 34:24Securing cookies
10. 39:01Strict transport security
11. 41:56CSRF and same-site cookies
12. 47:21Clickjacking and data leakage
13. 52:13Modern policy features and conclusion

" related talks

• 19mWeb Platform SecurityMike West · dotSecurity 2016
• 58mFixing XSS with Content Security PolicyKsenia Dmitrieva · AppSec California 2015
• 55mWeb Application Security: Browsers Fight Back!Christian Wenz · NDC London 2017
• 24mTowards a post-XSS world.Mike West · JSConf EU 2013
• 31mSecuring the DOM from the Bottom UpKrzysztof Kotowicz · JSNation 2019
• 36mSecuring the DOM from the Bottom UpMike Samuel, Krzysztof Kotowicz · Node+JS Interactive 2019
• 57mSecurityPatrick Hamann, Yan Zhu, Mike West, J. Alex Halderman, Henrik Rydberg, Dan Appelquist, Virginie Galindo · Edge Conference 2015
• 43mRestricting the scripts, you're ...Sebastian Roth, Ben Stock · RuhrSec 2020 #StayAtHome Edition