AppSec is Too Hard!?
summary
Shows concrete failures and fixes: a 2021 Apache Pulsar bug accepts crafted alg=none JWTs because Java parsing APIs are ambiguous, Burp plugins automate the exploit, and NHS and other apps still shipped the flaw years after 2015. Recommends test cases (include alg=none), prefer PS256 signatures, encapsulate JWT handling in a shared library, and follow Netflix’s paved road for bootstrapping. Frontend section demonstrates how misuse of dangerouslySetInnerHTML yields XSS, how DOMPurify plus a safe html wrapper and semgrep reduce noisy findings to a single audited hotspot.
AI-written summary · about
chapters (6)
- 0:00Start
- 1:01THE ROAD TO APPSEC HELL IS PAVED WITH GOOD INTENTIONS
- 12:28INCLUDE COMMON PITFALLS IN YOUR TEST SCENARIOS
- 31:22Signal Messenger
- 36:14ENCAPSULATE SECURITY BEHAVIOR IN LIBRARIES
- 38:38USING CODE HYGIENE FOR SECURITY SUCCESS
related talks
43mAppSec is too hard!?
53mKeynote: Philippe De Ryck - AppSec is too hard?
29mIntroduction to Web Security
41mWeb Security
34mWeb security explored through horror movies
59mDon't Get Burned! Secure Coding Essentials to Protect Your Application
27mCommon Application Security Mistakes that Enable Automated Attacks
31mXSS, CSRF, CSP, JWT, Wtf? Idk ¯\_(ツ)_/¯