Token Up: Keeping Hands out of the Cookie Jar
summary
Web session tokens should avoid localStorage and live in cookies scoped to subdomains with HttpOnly and Secure flags, and set SameSite=strict where possible (Chrome enforces this in ~Mar‑2020). Reject legacy content types (multipart/form‑data, text/plain, application/x‑www‑form‑urlencoded) on APIs to eliminate CSRF, use postMessage or WebSockets with strict origin checks for cross‑domain UI flows, prefer React/Vue virtual DOM to prevent XSS and ban dangerouslySetInnerHTML, and add static analyzers (eg. Brakeman) in CI.
AI-written summary · about
chapters (14)
- 0:00Start
- 0:24Aaron Browning
- 2:55Account Takeover
- 5:51Xss
- 7:28Test for Cross-Site Scripting
- 8:59Cross-Site Request Forgery
- 11:45Architecture Changes
- 19:35How Do You Reduce the Impact of Cross-Site Scripting
- 20:26Iframes
- 20:47Cross-Origin Communication
- 22:04Websockets
- 23:38How Can You Avoid Cross-Site Scripting
- 25:10Can You Prevent Cross Site Scripting Completely
- 25:56New Cookie Flag
related talks
29mToken Security in Single Page Applications
30mSingle Page Applications: Is your design secure?
27mCookies versus tokens: a paradoxical choice
26mSecuring Single Page Applications with Token Based Authentication
27mMastering Secure Single Page Apps & APIs
32mSecurity-First Web Apps
51mHTML5: Risky Business or Hidden Security Tool Chest?
44mMicro Frontends and Security