Vue Fortified: Best Practices for Web App Security
summary
Covers concrete Vue risks and fixes: demonstrates broken access control and SQL injection by running tests against OWASP Juice Shop that successfully bypass an admin page and log in via injection, shows Vue’s automatic HTML escaping (use curly bindings, never compile user templates), and warns against user-supplied attributes/events and style/URL injection. Recommends rate limiting, generic auth errors, short-lived sessions/refresh tokens, MFA/passkeys or OAuth, dependency checks with npm audit, snyk/RetireJS/dependency-check, and authorization via OpenFGA.
AI-written summary · about
chapters (12)
- 0:00Introduction and welcome
- 3:58Why web security matters
- 10:17OWASP top risks overview
- 12:03Broken access control risks
- 15:12Injection vulnerabilities
- 18:07Vue’s built-in protections
- 20:33Developer best practices
- 25:14Secure access control tips
- 27:47Authentication wishlist
- 29:14Dependency security guide
- 31:41Four key takeaways
- 33:09Final security reminders
related talks
31mVue Fortified: Best Practices for Web App Security
01h 31mSecure Vue app
31mVue tiful Defense Let's draw Security
07mHow Developers Can Use Automated App Security Testing To Protect Vue Apps
11mVue.js: Building Secure Applications
26mLet's talk about Security in Vue & Nuxt
28mWho are vue? Authn in Vue, the important parts
29mWho Are Vue? Authn In Vue, The Important Parts