Web Platform: The Secure Parts
summary
Claim: serve everything over HTTPS, enable HSTS so browsers always use TLS, set cookies with Secure and HttpOnly, and pin keys where practical; StartSSL provides free certs and StartSSL free certs (works in 99.8% of browsers). Use Content Security Policy with report‑only rollout then enforce to block injected scripts and receive JSON violation reports; sandbox iframe modules (eval runs in isolated origin) and use seamless or eval‑box patterns. Chrome/Firefox implement CSP now; deploy these to reduce, not eliminate, risk.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 2:07Web security attacks
- 3:50Mitigating MITM with SSL
- 8:27Enforcing HTTPS with HSTS
- 10:56Securing cookies with HTTP-only
- 11:16Public key pinning
- 15:05Content injection attacks
- 18:17HTML injection and escaping
- 22:50Content Security Policy basics
- 27:27CSP directives implementation
- 32:03Inline scripts and eval challenges
- 36:15Sandboxing iframes
- 40:49Summary
- 41:12Q&A
related talks
19mWeb Platform Security
55mWeb Application Security: Browsers Fight Back!
50mEnhancing Application Security: Understanding and Utilizing Browser Security Features
59mThe Final Frontier: Security APIs in Modern Browsers
29mBrowser Security in 2017
01h 04mCSP XXP STS PKP CAA ETC OMG WTF BBQ…
26mHTTP Headers - The Simplest Security
32mSecurity-First Web Apps