No Excuses Anymore: The Demise of Cross Site Scripting
summary
Claim: widespread XSS is avoidable now by concrete measures not theory. Evidence: CVE counts still climb but demos use HTTP header Content-Security-Policy with specific script/style/image sources, nonces or SHA hashes to restore inline behavior, disable unsafe-eval, and use Content-Security-Policy report-only to tune rules. For SPAs the demo wires trusted types + DOMPurify so innerHTML assignments fail unless explicitly sanitized, restoring functionality while blocking injected scripts.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 1:10Why cross-site scripting persists
- 3:21Defining XSS and impact
- 7:10Same origin policy role
- 10:28Browser XSS mitigation attempts
- 12:53Content Security Policy
- 15:22How Content Security Policy works with directives
- 18:51Demo of Content Security Policy breaking an application
- 24:47Re-enabling inline scripts with CSP
- 26:57Nonces and hashes for scripts
- 28:23Reporting CSP violations
- 29:51CSP firewall against XSS
- 30:12SPA XSS risks
- 32:46React dangerous APIs
- 34:50Trusted Types API
- 37:57Demo Trusted Types prevents XSS
- 39:03Summary and call to action
related talks
41mThe Last XSS Defense Talk: Why XSS Defense has radically changed in the past 7 years
47mXSS is dead. We just don't get it.
24mTowards a post-XSS world.
59mWeb Application Security Trends
58mFixing XSS with Content Security Policy
57mThe Last XSS Defense Talk
24mWe're struggling to keep up
25mPracticing Safe Script