How Do JavaScript Frameworks Impact The Security Of Applications?
summary
Compares real code across hundreds of projects and finds that framework-level mitigations only help when they’re actually used: automated parsing and custom ESLint rules analyze ~170 templates for XSS and ~364 apps for CSRF, producing concrete rates such as 38% Pug and 43% EJS vulnerable versus 12% AngularJS; for CSRF only 6/109 Express and 6/100 Koa apps enable protection, Hapi 0 and Sails 7, while Meteor’s websocket architecture and some JWT use eliminate CSRF without plugins — security defaults matter.
AI-written summary · about
chapters (24)
- 0:00Introduction
- 0:15About Ksenia
- 1:15Why JavaScript
- 1:43Frameworks
- 2:10Clientside frameworks
- 3:20Security in frameworks
- 4:40Levels of mitigation
- 5:26Example
- 6:42Security Mitigation
- 7:08Case Studies
- 8:25Github
- 10:38Analysis Pipeline
- 11:47Analysis Results
- 12:53Other Factors
- 14:31Crosssite request forgery
- 17:00Data selection
- 18:15The target
- 20:00Meteor
- 21:42Mitigation Control
- 22:39CSRF
- 23:19Results
- 25:14confounding variables analysis
- 25:52comparing the results
- 28:30QA
related talks
58mPractical Secure Development and Operations with JavaScript in 2020
48mSecurity Risk: Single-Page Applications.
47mAdvances in Secure Coding Frameworks
15mSafety Not Guaranteed
59mWeb Application Security Trends
08mHack Proofing Your JavaScript A Fun And Engaging Guide To Enhancing Security
47m30 Tips for Secure JavaScript
56mNode.js Security