The Art of Keeping Your Application Safe
summary
Intercom’s front end runs with ~51 authors, ~700 commits a month, 100+ deploys/day and ~20k additions/7k deletions, and the concrete takeaways are: a malformed <math> wrapper makes element.href return undefined and can leave unsanitized links that execute document.cookie (a real XSS); prefer element.getAttribute and building DOM text nodes over returning HTML; always add rel="noopener noreferrer" with target="_blank"; use ember-template-lint and an ESLint custom rule instead of grep+wc to fail builds; enforce a Content Security Policy and prefer composition over big components.
AI-written summary · about
chapters (5)
related talks
20mCounter-spells and the art of keeping your application safe
30mCounter-spells and the Art of Keeping Your Application Safe
19mCritical Security Mistakes in Frontend Applications
48mSecurity Risk: Single-Page Applications.
18mWriting an (in)secure webapp
42mYou thought your React application is secure? Think again
54mArchitecting Fortresses: A Deep Dive into Advanced Security Measures for ReactJS Apps
43mAppSec is too hard!?