Web security explored through horror movies
summary
Covers concrete OWASP failures: broken access control is top risk with invisible attackers; mitigate with deny‑by‑default authz, session invalidation, rate limiting and policy engines (CNCF/Open Policy Agent style). Cryptographic failures require TLS, data classification, and avoid storing sensitive data. Injection maps to the Alien allegory—use server‑side input validation, escaping (Vue helps), prepared statements and sanitizers. Outdated deps are the Blob—use Dependabot, npm audit, Snyk/retire.js and npm‑check‑updates plus CI tests. Also recommends short‑lived JWTs and OAuth refresh flows.
AI-written summary · about
chapters (8)
- 0:00Web security horror parallels
- 3:10Real web security horror stories
- 6:23Broken access control
- 12:08Cryptographic failures
- 16:27Injection attacks
- 23:14Vulnerable dependencies
- 28:57Security best practices
- 31:28Q&A
related talks
24mFrom the crypt to the code: Web security explored through horror movies
33mFrom the crypt to the code Web Security Explored Through Horror Movies
41mWeb Security
30mWeb Security Engineering - Protect all layers of your project
59mPractical Security for Web Applications
27mHow to Start Security Testing Without Fear
01h 04mWeb Security And You
18mWriting an (in)secure webapp