A bit of Web Application Security
summary
Covers concrete fixes for Strapi apps: follow the OWASP Top 10 but drop XXE and insecure deserialization as low risk for default Strapi, avoid raw SQL and Mongo objects by using ORMs and strict input validation, and prevent path traversal with path.resolve. Enforce cookie flags, store invalidated JWT ids in Redis and use expirations, avoid child_process exec and prefer spawn with sanitized args, run vulnerability scanners (Snyk/npm audit/GitHub Security), and use runtime protection like screen plus DOMPurify or Trusted Types for XSS.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:33OWASP Top 10 overview
- 3:48Handling quick wins
- 7:28Preventing injections
- 12:56Authentication security
- 16:14Sensitive data exposure
- 18:08Access control management
- 19:47Security misconfigurations
- 22:58Cross-site scripting (XSS)
- 25:15Dependency vulnerabilities
- 25:59Logging and wrap-up
related talks
32mOWASP Top 10 Vulnerabilities in Node.js
38mThe Security Toolbox For Node
56mNode.js Security
34mWeb security explored through horror movies
41mWeb Security
58mPractical Secure Development and Operations with JavaScript in 2020
01h 03mTen Key Steps for Enhanced Web App Security
24mFrom the crypt to the code: Web security explored through horror movies