Writing an (in)secure webapp
summary
Shows concrete failures: hash‑bang URLs let attackers build cross‑domain payloads that succeed when servers return Access-Control-Allow-Origin: , a live demo first fails then executes an alert in the app context, templating libraries still allow XSS because output encoding must be context‑specific (quote greater than less than single‑quote ampersand), recommends Content Security Policy (Firefox 4 feature) to block inline/remote scripts, warns about CSRF via GET delete endpoints, recommends X-Frame-Options* and HTTPOnly/secure cookies.
AI-written summary · about
chapters (11)
- 0:00Intro
- 0:27insecure webapps
- 0:46Introduction
- 1:52Stuff to talk about
- 2:35Writing Insecure Apps
- 3:15Why is it so easy?
- 6:08# navigation
- 9:34Cross-Site Scripting
- 9:59Context Matters
- 12:20Content Security Policy
- 14:36Other Crap That Matters
related talks
40mModern Web Application Defense with OWASP Tools
55mWeb Application Security: Browsers Fight Back!
59mWeb Application Security Trends
50mModern WebApp Vulnerabilities
30mSingle Page Applications: Is your design secure?
48mSecurity Risk: Single-Page Applications.
34mWeb security explored through horror movies
32mSecurity-First Web Apps