Critical Security Mistakes in Frontend Applications
summary
Story recounts two real incidents where attackers first replaced product images and later leaked the full database, then gives concrete defenses: run npm audit (and include it in CI/CD), enable Dependabot or Snyk, inspect GitHub issues before adding packages, and expect transitive deps to introduce risk; ban innerHTML/dangerouslySetInnerHTML and use sanitize-html plus server-side validation to stop XSS; stop logging reset tokens to observability tools like Datadog/Sentry/GA and use hashes instead of query params for sensitive links; add five-step threat modeling to every story.
AI-written summary · about
chapters (7)
- 0:00Introduction and speaker background
- 3:59Second order thinking in security
- 6:49Backdoor products and libraries risks
- 9:18Cross-site scripting vulnerabilities
- 12:07Security logging and data leakage
- 14:37Fishing and spoofing attacks
- 18:29Thread modeling for prevention
related talks
56mBuilding Secure ReactJS Applications: Mastering Advanced Security Techniques
58mPractical Secure Development and Operations with JavaScript in 2020
15mLocking Down PII: Why a Strong Frontend is Your First Defense
19mFrontend Security is a Thing
43mReact Security
30mWeb Security Engineering - Protect all layers of your project
45mSecurity When Working with npm: Threats, Cases and Stories
52mDemystifying Front-End Security