Facebook's Approach To Common Web Vulnerabilities
summary
Facebook describes concrete defenses and the things built and whether they work: it replaces fragile manual escaping with XHP escapes HTML by turning tags into objects and a JavaScript equivalent, it moves SQL from printf-style strings to SQL as objects plus lint rules that force constant format strings, it runs an automated escape detector sampled at about one in a million requests, it centralizes crypto into a URI signer and a separate crypto service so keys never live in web servers, and it uses rapid config rules and a bug‑bounty program (paid the largest reward for an XML external‑entity find) to mitigate live incidents.
AI-written summary · about
chapters (11)
- 0:00Intro
- 3:30Crosssite scripting
- 9:43Character set reinterpretation
- 12:15SQL injection
- 18:53Crosssite request forgery
- 26:11Scope guards
- 29:32Cryptography
- 35:32Syntaxalgrep
- 37:59Security vulnerabilities
- 42:25How to deal with vulnerabilities
- 46:12Clickjacking
related talks
37mFront-end Security
46mVulnerability Management at Scale
31mPlatform Integrity: Lessons Learned in Protecting the Facebook Platform
17mDesigning security and safety for billions
33mHacking The Front-End
19mFrontend Security is a Thing
24mSecuring your site like it's 1999
52mDemystifying Front-End Security