The other side of webapp security
summary
Covers practical steps to protect users: how naive HTTPS redirects leak login callbacks and bookmarks, why the redirect is insecure, and when HSTS preload (includeSubDomains + year max-age) actually prevents that; how to set secure cookies at the load balancer to stop session theft; how to deploy Content Security Policy with nonces or hashes and use report-uri.com and report-only mode to tune it safely. Includes pitfalls like legacy subdomains, APIs, and a real fix (move internal services off the public domain).
AI-written summary · about
chapters (20)
- 0:00Introduction
- 0:14Poll
- 1:37MITM
- 2:03Forced HTTPS
- 2:27Hiding plaintext addresses
- 4:01Bookmarks
- 4:17HTTP
- 4:54Redirect
- 5:29Enter HSTs
- 6:20Upgrade to HTTPS
- 7:40HSTS Preload
- 8:53HSTS Gotcha
- 9:33Timeout
- 10:54Cookies
- 12:10XSS
- 13:34Nonce
- 15:03CSP hashes
- 15:28CSP header
- 17:16CSP report
- 17:40Questions
related talks
32mSecurity-First Web Apps
40mContent Security Policy to the Rescue
55mWeb Application Security: Browsers Fight Back!
41mWeb Security
59mHTTP Security Headers You Need To Have On Your Web Apps
18mWriting an (in)secure webapp
49mCookie Security Myths and Misconceptions
52mSeatbelts for Web App (Security Headers)