Single Page Applications: Is your design secure?
summary
Demonstrations show a simple script extracting tokens from Chrome storage and an XSS payload reading those tokens from storage to exfiltrate them, proving XSS in a tokenized SPA is game over. Scans flag Access-Control-Allow-Origin: but requests carry Authorization headers not cookies so wildcard CORS is often acceptable; Burp flags require manual validation. Practical guidance: use token-based authentication, store sensitive tokens in sessionStorage not localStorage*, deploy CSP as defense‑in‑depth while auditing any template or DOM APIs that bypass framework protections.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 0:35Why SPX
- 2:16Stateful vs Stateless
- 4:10JSON
- 6:13Cache Control
- 7:05Local Storage
- 10:27Resource Sharing
- 12:02Demo
- 16:15Crosssite scripting demo
- 18:14CSP
- 19:40Key takeaways
- 25:11HTTP only flag
- 28:07How to steal data
related talks
29mToken Security in Single Page Applications
27mAuthentication in Single Page Applications
48mSecurity Risk: Single-Page Applications.
18mWriting an (in)secure webapp
55mWeb Application Security: Browsers Fight Back!
28mOffensive and Defensive Strategies for Client-Side JS Security
26mSecuring Single Page Applications with Token Based Authentication
56mSPArring with the Security of Single Page Applications