How Developers Can Use Automated App Security Testing To Protect Vue Apps
summary
Shows a concrete Vue XSS exploit on a message board where using v-html leads to XSS and a hidden image tag exfiltrates session data, then demonstrates fixes: switching to text rendering breaks formatting, sanitize-html removes malicious tags while preserving styling, and adding a CSP header tightens policy. Runs a StackHawk dynamic scan against the running app integrated into CI/CD and surfaces a few CSP-related findings that can be triaged and remediated before production.
AI-written summary · about
chapters (6)
- 0:00Start
- 0:28About Me
- 1:41Dynamic Application Security Testing
- 1:58Cross-Site Scripting
- 5:17Adding the Csp Header
- 6:25Learn More about Stackhawk
related talks
31mVue tiful Defense Let's draw Security
35mVue Fortified: Best Practices for Web App Security
31mVue Fortified: Best Practices for Web App Security
01h 31mSecure Vue app
48mSecurity Risk: Single-Page Applications.
23mJavaScript attack surface
32mWriting Secure JavaScript Code
32mLet me show you how React applications get hacked in the real-world