Scala Security: Examining the Play and LiftWeb Frameworks
summary
Compares LiftWeb and Play against the OWASP Top 10 with concrete findings: Lift’s built-in sitemap and DOM-based CSRF give strong defaults but can be weakened by developer flags; Play signs sessions with an application.secret (often accidentally hard-coded) and exposes unsigned flash cookies and an opt-out HTML escape that enables XSS. Shows a man‑in‑the‑middle PoC where build tools fetch jars/config over HTTP (Closure/SBT/Activator issues) and releases a vulnerable demo app blabber plus a Scala HTTP helper anti-ssrf to block server‑side request forgery.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 1:44Scala framework overview
- 4:03Web application structure
- 6:35SQL injection prevention
- 12:00Injection and user management
- 14:42Cookie security
- 15:57XSS and templating
- 21:07Insecure object references
- 22:56Security misconfiguration
- 27:35Authorization and data safety
- 31:12CSRF protection
- 33:17Build system vulnerabilities
- 37:01Redirects and dependencies
- 39:52Best practices and future
- 43:38Demos and closing
related talks
44mnew framewords old problems
40mModern Web Application Defense with OWASP Tools
44mShift-Left-Security with the Security Test Pyramid
50mAppSec is Too Hard!?
01h 06mLive hacking: Breaking into your Java web app
34mJS Security - A Pentesters Perspective
34mWeb security explored through horror movies
50mStranger Danger: Your Java Attack Surface Just Got Bigger