Front-end Security

on YouTube ↗37m

" summary

Examines concrete front-end XSS case studies including a Twitter URL/hash vulnerability that allowed javascript: execution via a window.location replace bug and required regex and sandboxing for a proper fix. Describes deployed defenses and tools: Content Security Policy with report-uri and nonces, HSTS headers, HttpOnly cookies, preferring POST over GET, CSP generators, scanner tooling and browser support matrices, and reports implementation outcomes (including 133 Flash vulnerabilities found in 2015).

AI-written summary · about

" chapters (19)

1. 0:00Frontend security intro
2. 1:37Why frontend security matters
3. 2:26What is XSS and types
4. 3:55Non-persistent XSS Twitter case
5. 7:51Fixing XSS flaw on Twitter
6. 10:08Stored XSS and consequences
7. 13:46Angular templates and XSS
8. 15:35Active vs passive XSS
9. 17:57Browsers as security helpers
10. 18:19Content Security Policy basics
11. 22:55CSP version 2 features
12. 23:35HTTPS and MITM risks
13. 26:27Public Wi-Fi security risks
14. 27:10VK account hacks explained
15. 28:11Strict Transport Security role
16. 29:18Cookie protection methods
17. 30:45Adobe Flash security issues
18. 31:09Frontend security tips
19. 32:33Q&A

" related talks

• 52mDemystifying Front-End SecurityIlya Verbitskiy · NDC Sydney 2020
• 19mFrontend Security is a ThingMadalina Cotumbeanu · DrupalCon Amsterdam 2019
• 59mWeb Application Security TrendsChristian Wentz · NDC Oslo 2018
• 33mHacking The Front-EndAlex Sexton · Full Stack Fest 2015
• 23mJavaScript attack surfaceDavit Karapetyan · JavaScript Summit Armenia 2023
• 55mWeb Application Security: Browsers Fight Back!Christian Wenz · NDC London 2017
• 24mWe're struggling to keep upFrederik Braun · JSConf EU 2014
• 58mFixing XSS with Content Security PolicyKsenia Dmitrieva · AppSec California 2015