How to Improve Your Web Application’s Security using Mozilla Observatory
summary
Runs a Mozilla Observatory scan of a real personal site and shows the overall score plus per-metric failure reasons, then implements fixes: adds a locked-down Content Security Policy with CSP report-only to collect violations before blocking, demonstrates specific directives (script-src, img-src, font-src), sets cookie flags Secure, HttpOnly and SameSite=strict, explains CORS preflight headers and Access-Control-Allow- responses, configures HSTS and correct HTTPS redirection, uses Subresource Integrity with integrity + crossorigin=anonymous*, and enables nosniff and frame-ancestors/X-Frame-Options.
AI-written summary · about
chapters (10)
- 0:00Web app security with Mozilla Observatory
- 1:28Content Security Policy basics
- 3:18Advanced CSP examples
- 6:07Securing cookies
- 8:38Cross-Origin Resource Sharing
- 11:06HSTS and HTTPS best practices
- 14:05Referrer policy for privacy
- 16:13Subresource Integrity
- 18:45MIME sniffing attacks
- 19:30Clickjacking with X-Frame-Options
related talks
50mEnhancing Application Security: Understanding and Utilizing Browser Security Features
55mWeb Application Security: Browsers Fight Back!
59mThe Final Frontier: Security APIs in Modern Browsers
29mBrowser Security in 2017
13mSecurity in modern Web Applications - OWASP to the rescue
40mContent Security Policy to the Rescue
33mHacking The Front-End
32mSecurity-First Web Apps