Securing your Grails App - Beyond Authentication & Authorization
summary
Covers application security for Grails apps by examining vulnerabilities beyond just authN/authZ. Focuses on recognizing attack vectors and applying vigilant defensive practices to thwart threats in Grails-based applications.
AI-written summary · about
chapters (14)
- 0:00Start
- 1:19Disclaimer #2 Text
- 8:55OWASP
- 11:36SQL Injection • #1 issue on the web
- 16:58HQL Injection Similar, different syntax.
- 18:14HQL Injection use parameterized HQL
- 20:27Databinding Injection Grails 1.3.7 (pre 1.3.8) class MyDonainobject def SpringSecurityService
- 22:35Association Injection Updating associations that don't belong to that user
- 25:47Command Injection Subtitle
- 27:39Log Injection Extra lines in log files that look real!!
- 36:55Session Fixation Subtitle
- 43:44Account Management flow • Unencrypted transports Account signup Password hint exposure
- 57:39Javascript Injection Via DOM injection of a tag or eval
- 59:04Direct Execution
related talks
42mSecuring Your Rails App
36mNo Such Thing as a Secure Application
31mRails Application Security in Practice
38mPrioritizing Trust While Creating Applications
43mSecuring Your Rails App
46mApplication Gateway Security What Developers Really Need to Know
28mHow to Effect Change in the Epistemological Wasteland of App Security
50mAttack Your Apps Before the Bad Guys Do