Security Risk: Single-Page Applications.
summary
Single-page apps carry concrete risks and concrete fixes: XSS is the top client issue, fixed by framework encoding plus sanitizers (use DOMPurify for React/Vue; Angular already encodes and sanitizes), and DOM-based XSS is blocked with Trusted Types enforced via CSP require-trusted-types-for 'script' (polyfill for unsupported browsers). CSRF defenses include the double submit cookie or switching to authorization code with PKCE / a backend‑for‑frontend to avoid implicit flow. Demoed innerHTML blocked then sanitized with DOMPurify; use npm audit, Sentry and CSP/reporting for monitoring.
AI-written summary · about
chapters (16)
- 0:00Introduction to speaker
- 1:07What are SPAs
- 3:19OWASP Top 10 for SPAs
- 7:38Broken access control risks
- 13:14Authorization failures
- 14:00Cross-site scripting explained
- 18:39DOM-based XSS risks
- 20:03Defending against XSS
- 24:01Trusted Types demo
- 26:28Angular security features
- 32:50React and Vue security
- 35:02Framework security comparison
- 37:35Vulnerable dependencies
- 38:20OAuth authentication flaws
- 40:32Logging and monitoring gaps
- 42:01Summary and best practices
related talks
50mBuilding Secure React Applications
59mWeb Application Security Trends
30mSingle Page Applications: Is your design secure?
56mSPArring with the Security of Single Page Applications
15mLocking Down PII: Why a Strong Frontend is Your First Defense
25mDo not let your React be injected
54mArchitecting Fortresses: A Deep Dive into Advanced Security Measures for ReactJS Apps
18mWriting an (in)secure webapp