AppSec is too hard!?
summary
Shows a concrete React XSS path where using dangerouslySetInnerHTML without sanitization lets an image onerror alert execute, recommends using DOMPurify and replacing ad-hoc uses with a single SafeHtml component (running Semgrep then reports zero findings). Documents a decade-old JWT failure class where an alg: none acceptance led to Apache Pulsar account takeover, notes the Burp “JSON Web Token attacker” helper, and argues to encapsulate JWT handling in one vetted library, pick sane algorithms (PS256/EdDSA) and include automated tests.
AI-written summary · about
chapters (38)
- 0:00Intro
- 0:52Good intentions
- 2:09How do you build secure software
- 4:40React example
- 5:16Practical examples
- 7:15HTML rendering
- 8:02React dangerously set inner HTML
- 10:24The solution
- 11:51First takeaway
- 13:45Documentation
- 14:40Its not enough
- 15:33Code Scan
- 20:35Save HTML
- 21:47Simplify your code
- 22:36Zero findings
- 23:41Encapsulation
- 24:07Chasing Web Tokens
- 24:48What is a JSON Web Token
- 25:39Apache Pulsar vulnerability
- 26:22Jot vulnerability
- 27:06Dark mode
- 27:48Open Source Documentation
- 28:38Elginon Problem
- 29:05Attack
- 30:57Common Pitfalls
- 32:47Json Web Tokens
- 33:08Digital Signatures
- 34:10Parse Claims
- 34:39Key Rotation
- 35:13What I need to learn
- 36:33Why encapsulate
- 37:37Flexibility
- 38:08Netflix
- 40:44Takeaways
- 41:13Security Awareness
- 41:40Encapsulate
- 42:07Leverage tooling
- 42:29Shameless plug
related talks
50mAppSec is Too Hard!?
53mKeynote: Philippe De Ryck - AppSec is too hard?
41mWeb Security
31mXSS, CSRF, CSP, JWT, Wtf? Idk ¯\_(ツ)_/¯
54mArchitecting Fortresses: A Deep Dive into Advanced Security Measures for ReactJS Apps
07mWhat is an XSS attack - and why should you care?
50mBuilding Secure React Applications
48mSecurity Risk: Single-Page Applications.