Philippe De Ryck
where else to find them
website:https://pragmaticwebsecurity.com
github:philippederyck
bluesky:philippederyck.bsky.social
linkedin:PhilippeDeRyck
what they talk about
all 5 in the filters
where they keep going back
- NG-BE5 editions2016–2021
- NDC Security4 editions2022–2025
- NDC Oslo2 editions2024–2025
all 16 in the filters
on a stage with
never shared a talk
who talks about the same things
- Kim Maida15 talks
- Ben Dechrai29 talks
- Anders Abel14 talks
- Tobias Ahnoff8 talks
- Jim Manico28 talks
- Erlend Oftedal12 talks
| title | conference | date |
|---|---|---|
| Supercharging OAuth 2.0 security | NDC Oslo 2025 | 2025-05-19 |
Covers concrete upgrades: Resource Indicators for per-API access tokens and downscoping (one token per API), RFC 9101 JAR (JWT request objects) and PAR (pushed… | ||
| Breaking and securing OAuth 2.0 in frontends at NDC Security | NDC Security 2025 | 2025-01-20 |
Demo web app and attacker server show malicious script steals tokens (exfiltrates access + refresh tokens to attacker domain) and a second demo uses a silent… | ||
| SEVEN things about API security | NDC Security 2025 | 2025-01-20 |
Covers concrete failures and fixes: shows SSRF via parser ambiguity where URL parsers and libcurl disagree and internal services become reachable; reproduces a… | ||
| Supercharging OAuth 2.0 Security | CPH DevFest 2024 | 2024-08-26 |
Walks through concrete fixes: request objects become signed JWTs so parameters can’t be tampered (JAR), or the client pushes the whole request to the STS and… | ||
| SEVEN things about API security | NDC Oslo 2024 | 2024-06-10 |
Explains four OWASP API issues with concrete fixes: an SSRF bypass via @@-style URLs that fooled Dropbox-style hostname checks and curl, fixed by parsing once… | ||
| The Past, Present, and Future of Cross-Site/Cross-Origin Request Forgery | NDC Security 2024 | 2024-01-09 |
Cross-site forgery is largely neutralized by SameSite cookies for typical cookie-auth apps, but APIs remain vulnerable because forms and fetch can deliver… | ||
| The Past, Present, and Future of Cross-Site/Cross-Origin Request Forgery | NDC Security 2024 | 2024-01-09 |
CSRF remains real for cookie-based auth: demos show hidden-form and fetch attacks creating reviews against a legacy app and an API, and real incidents include… | ||
| AppSec is too hard!? | Voxxed Days Brussels 2023 | 2023-05-23 |
Shows a concrete React XSS path where using dangerouslySetInnerHTML without sanitization lets an image onerror alert execute, recommends using DOMPurify and… | ||
| Getting API security right | NDC London 2023 | 2023-01-23 |
A survey of ~30 e‑health apps finds 77% had hard‑coded API keys and 7% exposed credentials, and every inspected backend shows broken object‑level authorization… | ||
| The insecurity of OAuth 2.0 in frontends | NDC Security 2023 | 2023-01-16 |
Claim: OAuth 2.0 flows run entirely in the browser are fundamentally insecure. Demonstrations build a toy restaurant app, a malicious server and an attack.js… | ||
| Securing an API Ecosystem with OAuth 2 0 | OWASP 2022 Global AppSec Europe Virtual Event | 2022-11-04 |
Concrete rules and tradeoffs: use the authorization code grant with PKCE for any user flows and the client credentials grant for machine-to-machine; prefer… | ||
| Securing Angular with Trusted Types | NG-DE Conference 2022 | 2022-10-06 |
Claims that enabling require-trusted-types-for 'script' plus allowing Angular’s built-in policy prevents DOM-based XSS by making innerHTML accept only… | ||
| AppSec is Too Hard!? | NDC Security 2022 | 2022-04-06 |
Shows concrete failures and fixes: a 2021 Apache Pulsar bug accepts crafted alg=none JWTs because Java parsing APIs are ambiguous, Burp plugins automate the… | ||
| Getting API Security Right | NDC Security 2022 | 2022-04-06 |
A study of 30 UK healthcare apps finds 77% hard-coded API keys and 7% with embedded usernames/passwords, and every tested API shows authorization flaws… | ||
| Securing Angular with Trusted Types | NG-BE 2021 | 2021-12-02 |
Claims that Trusted Types can largely eliminate DOM‑based XSS by rejecting text assignments to dangerous sinks such as innerHTML, requiring a… | ||
| Keynote: Philippe De Ryck - AppSec is too hard? | OWASP 20th Anniversary 2021 | 2021-09-24 |
Modern AppSec fails on concrete details: JSON Web Token libraries expose six parsing methods so developers accidentally accept unsigned tokens — an alg=none… | ||
| Token Security in Single Page Applications | sec4dev 2021 | 2021-02-22 |
Explains that localStorage persists across tabs and restarts and is trivially readable by any same-origin script so XSS can steal access and refresh tokens… | ||
| OAuth2 and OpenID Connect for Single Page Applications | OWASP Global AppSec Virtual 2020 | 2020-10-22 |
Covers secure OAuth 2.0/OpenID Connect patterns for Single Page Applications: move away from implicit flow to Authorization Code Flow with PKCE, use… | ||
| Common API Security Pitfalls | NDC London 2020 | 2020-01-27 |
APIs commonly leak full JSON or images because endpoints trust identifiers instead of enforcing ownership checks, causing broken object level access control… | ||
| Common API Security Pitfalls | NDC Security Oslo 2020 | 2020-01-22 |
Covers concrete API mistakes and fixes: rely never on the client for authorization, audit and centralize access policies to prevent broken object level access… | ||
| Authentication with OpenID Connect in Angular Applications | NG-BE 2019 | 2019-12-05 |
Argues that authentication should be delegated to an identity provider via OpenID Connect and shows concrete flows: hybrid flow (id_token + code) for backends… | ||
| Angular and the OWASP top 10 | AngularConnect 2019 | 2019-09-19 |
Claims that Angular auto-sanitizes bindings and blocks common XSS vectors while still requiring explicit trust for resource URLs and bypass APIs, shows a live… | ||
| Angular and the OWASP top 10 | NG-BE 2018 | 2018-12-06 |
Advocates HTTPS everywhere with Let's Encrypt and HSTS, recommends cookie Secure/HttpOnly and host prefixes, warns CORS misconfiguration can leak tokens (real… | ||
| Introduction to OAuth 2.0 and OpenID Connect | GOTO Berlin 2018 | 2018-10-31 |
Explains how OAuth delegates access using an authorization server, shows three concrete flows: client credentials for machine-to-machine, authorization code… | ||
| From the OWASP Top Ten(s) to the OWASP ASVS | GOTO Berlin 2018 | 2018-10-31 |
Compares the OWASP Top Ten 2017 and Proactive Controls 2018 to ASVS v3.1 and shows concrete requirements not platitudes: over 150 requirements across 16… | ||
| Cookies versus tokens: a paradoxical choice | NG-BE 2017 | 2017-12-07 |
Compares concrete session patterns (server-state vs client-side JWTs), demonstrates broken code and fixes (shows a decode call that skips JWT signature… | ||
| Common REST API security pitfalls | OWASP BeNeLux Day 2017 | 2017-11-24 |
Checklist style evaluation says whether to watch: the session names specific failures and fixes — missing authorization on ID-based endpoints, client-side… | ||
| Common API security pitfalls | Devoxx Belgium 2017 | 2017-11-06 |
HTTPS is mandatory and browsers should get HSTS for a year; always enforce TLS before any higher-level checks. Enforce rate limits per API key or account to… | ||
| Boosting the security of your Angular 2 application | NG-BE 2016 | 2016-12-08 |
Angular 2 claims to stop XSS by auto-escapes and sanitizes untrusted data, and it offers an ahead-of-time compilation path that prevents template-injection… | ||
| nothing matches | ||