Vue tiful Defense Let's draw Security
summary
Vue actually auto‑escapes template, render and attribute bindings but has edge cases: VHTML disables auto‑escaping, never compile untrusted templates. The session shows two real CVEs — a prototype pollution in an i18n package and a regex DoS in a dependency — and recommends concrete defenses: dependency scanners like retirejs and OWASP checkers, build hygiene and vetting AI code, Content Security Policy for mitigations, and openFGA for authorization. Live sketch notes and a sanitiser recommendation (DOMPurify) get merged into a downloadable cheat sheet.
AI-written summary · about
chapters (13)
- 0:00Vue security introduction
- 1:16Castle analogy for app security
- 3:24Vue XSS protections
- 5:39Dependency supply chain risks
- 9:16Mitigating supply chain risks
- 11:21OWASP for web security
- 13:05Broken access control in Vue Router
- 16:37XSS and prototype pollution
- 20:10Vue escaping edge cases
- 23:24Clickjacking attack vectors
- 26:01Content Security Policy shield
- 28:36Vue security summary
- 30:22Closing remarks
related talks
31mVue Fortified: Best Practices for Web App Security
35mVue Fortified: Best Practices for Web App Security
07mHow Developers Can Use Automated App Security Testing To Protect Vue Apps
01h 31mSecure Vue app
23mJavaScript attack surface
15mSafety Not Guaranteed
54mArchitecting Fortresses: A Deep Dive into Advanced Security Measures for ReactJS Apps
48mSecurity Risk: Single-Page Applications.