Advances in Secure Coding Frameworks
summary
Claims that modern frameworks provide automatic defenses on by default get concrete examples: Rails auto-escapes but HTML safe undermines it, React JSX auto-escapes yet has event and URL edge cases, Go templates perform contextual escaping that fails to compile unsafe templates, and Angular combines auto-escaping HTML sanitization and CSP plus a double-submit XSRF pattern. Language-level and runtime proposals appear too: PHP taint-tracking to block SQL injection at runtime, sameSite cookies and CSP upgrade rules aim to remove whole classes of bugs.
AI-written summary · about
chapters (18)
- 0:00Start
- 1:48Framework Control Maturity Model
- 8:13Authentication
- 8:49Automated Cross-Site Scripting Defense
- 14:05Go Templates
- 17:54Automatic Escaping
- 19:03Where Does Your App Go Wrong
- 23:24Cross-Site Request Forgery Defense
- 24:43Double Submit Cookie Defense
- 25:32Why Does this Defense Work
- 26:09Double Cookie Submit
- 27:15Emerging Defenses
- 29:28Json Hijack
- 32:11Sequel Injection Defense
- 34:15What Technology Did You Have in 2007 That Stops Sequel Injection
- 40:18Upgrade and Secure Request Call
- 41:59Html Validation
- 45:31Why I Like Angular
related talks
34mHow Do JavaScript Frameworks Impact The Security Of Applications?
58mPractical Secure Development and Operations with JavaScript in 2020
54mArchitecting Fortresses: A Deep Dive into Advanced Security Measures for ReactJS Apps
31mBoosting the security of your Angular 2 application
48mSecurity Risk: Single-Page Applications.
48mSecuring Software’s Future
50mBuilding Secure React Applications
31mAchieving Secure Software through Redesign