SPArring with the Security of Single Page Applications
summary
Single page applications shift real work to the client and break conventional scanners by hiding REST calls and parameter structure so testing must target the actual claim and mechanism not the topic alone For example Reacts virtual DOM registers one event which defeats naive event crawlers JSON and custom formats require per parameter injection and escaping OAuth and signed headers block naive fuzzing A tested countermeasure is tooling that supports importing swagger documents and updated scanners such as AppSpider adding React support and practical demos show replayable Twitter direct message via old API vulnerabilities.
AI-written summary · about
chapters (22)
- 0:00Intro
- 0:52Tale of the Tape
- 3:55Our Introduction to Martial Arts
- 4:10Individual "Martial Arts" Disciplines
- 5:26Which Discipline is better?
- 6:57Which attacks are better?
- 8:14Starting to "Mix" Disciplines
- 9:38Possible levels of a fight
- 11:13Modern fighters must be well rounded
- 12:58JavaScript becomes Asynchronous
- 13:37Applications getting more difficult
- 14:37HTTP Standard Format
- 16:22Swing and a Miss
- 16:56Landing the blow
- 21:37Crawling AJAX Apps
- 26:06SPA Frameworks
- 29:11REACT Virtual DOM: Breaking scanners
- 31:41REACT Recap
- 32:14Don't forget Mobile!
- 35:26Sample Custom Signing Code
- 42:02Embrace the challenge
- 42:31Thank you!
related talks
48mSecurity Risk: Single-Page Applications.
30mSingle Page Applications: Is your design secure?
43mAppSec is too hard!?
40mModern Web Application Defense with OWASP Tools
27mMastering Secure Single Page Apps & APIs
50mAppSec is Too Hard!?
32mSecurity-First Web Apps
08mAutomated Security Testing for JS Apps