Vue Fortified: Best Practices for Web App Security
summary
Vue’s template binding already escapes HTML and attributes, but the talk warns that never use non-trusted templates because compiled templates run as JS; front-end injection (XSS, URL/style/script injection) is the primary risk to address. Practical steps: use DOMPurify / sanitize-url or iframe sandboxes for user HTML/URLs, prefer v-text/object-style bindings, validate props, and keep deps patched—update dependencies with Dependabot or npm audit; OWASP top 10 and broken access control (≈95% occurrence in tests) guide priorities.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 1:10Fortified view
- 5:13What are the most dangerous risks
- 6:20Broken Access Control
- 8:21Injections
- 14:27User Provision
- 15:14URL Injection
- 16:47Style Injection
- 17:37User Control
- 18:24User Style
- 18:52Script Injection
- 20:00Dependency Management
- 20:54Summary
- 23:02Vulnerability Reporting
- 23:23More Best Practices
- 23:49Questions
related talks
35mVue Fortified: Best Practices for Web App Security
31mVue tiful Defense Let's draw Security
01h 31mSecure Vue app
07mHow Developers Can Use Automated App Security Testing To Protect Vue Apps
48mSecurity Risk: Single-Page Applications.
54mArchitecting Fortresses: A Deep Dive into Advanced Security Measures for ReactJS Apps
50mBuilding Secure React Applications
56mBuilding Secure ReactJS Applications: Mastering Advanced Security Techniques