Keynote: Philippe De Ryck - AppSec is too hard?
summary
Modern AppSec fails on concrete details: JSON Web Token libraries expose six parsing methods so developers accidentally accept unsigned tokens — an alg=none bypass that hit Apache Pulsar and is trivial with a Burp Suite add‑on; choosing parseClaimsJws vs parse or the wrong verify call breaks integrity. Front end frameworks expose DOMPurify sanitizer as the right fix for dangerouslySetInnerHTML but apps often omit it. Remedies that work: Semgrep scans, encapsulated safeHtml components, and internal security products (Netflix style) that drop findings from dozens to zero.
AI-written summary · about
chapters (12)
- 0:00Start
- 2:43THE ROAD TO APPSEC HELL
- 19:45INCLUDE COMMON PITFALLS IN YOUR TEST SCENARIUS
- 22:56WHAT DOES IT TAKE TO HANDLE A JWT CORRECTLY?!
- 29:32The Show Must Go On: Securing Netflix Studios At Scale
- 30:53RE-USE SECURITY LIBRARIES
- 38:47AVOID ACCIDENTAL MISUSE OF DANGEROUS FEATURES
- 41:43Signal Messenger
- 42:15MARKING THINGS AS DANGEROUS IS NOT ENOUGH
- 46:08ENCAPSULATE SECURITY BEHAVIOR IN LIBRARIES
- 47:53USING CODE HYGIENE FOR SECURITY SUCCESS
- 50:19THANK YOU!
related talks
50mAppSec is Too Hard!?
43mAppSec is too hard!?
08mHack Proofing Your JavaScript A Fun And Engaging Guide To Enhancing Security
58mPractical Secure Development and Operations with JavaScript in 2020
55mBreaking and Fixing Web Application Security
19mCritical Security Mistakes in Frontend Applications
37mHow to get developers to want to adopt AppSec
41mWeb Security