Secure Coding Back to Basics
summary
Argues that shifting validation into small, typed domain primitives and using DTOs/contract objects avoids bugs that become vulnerabilities, shows Kotlin/TypeScript code patterns (Either, immutable value objects), demonstrates using DOMPurify and browser Trusted Types to stop XSS, recommends parameterized queries to prevent SQLi, describes preventing mass assignment via anti-corruption layer/DTOs, reports using the approach on a three‑year project where it caught many logic bugs though schema changes and memory tradeoffs require migration effort.
AI-written summary · about
chapters (19)
- 0:00Start
- 0:11Secure Coding Back to Basics
- 1:52Complexity Is the Enemy of Security
- 4:37Standard Runtime Bug
- 7:50Anti-Corruption Layer
- 13:37Product Id
- 15:39Normalize Input
- 27:39User Registration
- 29:28Apis
- 31:10Mass Assignment Attack
- 38:51Input Validation
- 39:57Cross-Site Scripting in Sql Injection
- 41:50Process Scripting
- 45:21Trusted Html
- 46:17Default Policy
- 47:05Typescript
- 49:35Input Validation of Json Data
- 50:18Registration Parser
- 56:24Input Validation and Encoding
related talks
38mSecure Coding: Back to basics
46mSecure Coding Patterns
52mSecure by Design, Revisited - Insights & Pitfalls
50mCracking the Code to Secure Software
35mSafeguarding Large-Scale Projects: Navigating TypeScript Security Pitfalls
51mPreventing Security Bugs through Software Design
31mAchieving Secure Software through Redesign
40mSecure Software & Domain Driven Design