30 Tips for Secure JavaScript
summary
Thirty concrete JavaScript rules: use a framework that outputs safe markup, avoid inline scripts and dangerous APIs like eval, innerHTML, document.write and with, prefer textContent/createElement and encodeURIComponent, and enforce CSP and subresource integrity (SRI) for third‑party scripts. Defend against XSS, DOM XSS and prototype injection by freezing prototypes or using Map, check for HTTP parameter pollution (use HPP middleware), run static analysis and dependency scans (npm audit, retire.js, NodeJS scan, DOMPurify), and enable encodeURIComponent and strict mode.
AI-written summary · about
chapters (37)
- 0:00Introduction
- 1:28Secure JavaScript matters
- 6:27Frameworks for encoded code
- 7:31Secure development lifecycle
- 8:55Cross-site scripting risks
- 12:45Avoid inline scripting
- 13:48User input as data
- 14:50Use textContent over innerHTML
- 15:34encodeURIComponent vs escape
- 16:38Avoid document.write
- 17:39Replace unescapeHTML
- 18:22decodeURIComponent vs decodeURI
- 19:04URL encode for CSS
- 20:09Double-encode execution context
- 20:30Specify text content
- 21:55Safe setAttribute
- 23:59Explicit content type headers
- 24:22CSS for variables
- 25:04Strict mode for security
- 26:07HTTP parameter pollution
- 27:53Sanitize with DOMPurify
- 28:36Script integrity with SRI
- 29:18Minify sensitive code
- 30:00Prevent cross-site request forgery with tokens
- 31:45Linters and static analysis
- 33:31Avoid eval
- 34:15Never use the with statement in JavaScript
- 34:57Avoid function constructors
- 36:45Caution with setTimeout
- 37:53No untrusted HTML methods
- 38:35Prevent prototype injection
- 39:39Same-origin policy
- 40:45Backend input validation
- 42:12Prefer private variables
- 42:34Free tools for security
- 43:58Conclusion and key takeaways
- 44:20Free secure coding resources
related talks
32m30 Tips for Secure JavaScript
08mHack Proofing Your JavaScript A Fun And Engaging Guide To Enhancing Security
58mPractical Secure Development and Operations with JavaScript in 2020
50mBuilding Secure React Applications
33mHacking your Front-End Apps
15mSafety Not Guaranteed
52m10 Awesome Tips for Enterprise JavaScript
35mSafeguarding Large-Scale Projects: Navigating TypeScript Security Pitfalls