The Last XSS Defense Talk: Why XSS Defense has radically changed in the past 7 years
Talkat OWASP AppSec Europe 2018 · on Thursday, 2018-07-05· at 13:30· Fleming - 3rd Floor, QEII Centre Broad Sanctuary, Westminster·
summary
XSS remains pervasive and hard to fix; defense shifts from vague advice to concrete tactics: use DomPurify to wrap dangerous innerHTML (one auditor locks down ~3000 sinks in a day), prefer contextual escaping at render time not before DB storage, avoid server‑side React/Angular rendering to prevent template injection, treat HTTPOnly is almost useless against in‑site AJAX, never use eval or JSON.stringify for embedded JSON, sandbox third‑party ads in iframes, and deploy strict-dynamic CSP with nonces for modern browsers while falling back safely for older ones.
AI-written summary · about
chapters (12)
- 0:00Introduction to XSS
- 2:14Understanding XSS attacks
- 4:09The limitations of defense
- 7:20Impact and severity of XSS
- 9:22Contextual output escaping
- 12:09Advanced defensive patterns
- 17:02HTML and DOM sanitization
- 21:55Safe DOM interactions
- 25:19Secure JSON handling
- 26:51Sandboxing dangerous content
- 28:40Content Security Policy
- 33:25Q&A and closing thoughts
related talks
57mThe Last XSS Defense Talk
43mNo Excuses Anymore: The Demise of Cross Site Scripting
24mWe're struggling to keep up
59mWeb Application Security Trends
52mDemystifying Front-End Security
31m360° View of XSS
23mJavaScript attack surface
42mEverything you need to know about client-side malicious code execution