30 Tips for Secure JavaScript
summary
Thirty concrete JavaScript practices and a few extras, with exact do/avoid rules: use encodeURIComponent/decodeURIComponent for URL parts, prefer document.createElement and element.textContent over innerHTML, enable CSP and set cookies HttpOnly, add SRI for CDN scripts, run npm audit or yarn audit plus a security static analyzer and linter, defend against HPP and CSRF with server-side validation and tokens, avoid eval/new Function and passing code strings, freeze prototypes or use Object.create(null), and try tools like DOMPurify and retire.js.
AI-written summary · about
chapters (28)
- 0:00Secure JavaScript intro
- 3:26Why security matters
- 6:12Output encoding in frameworks
- 6:56Secure development lifecycle
- 8:21Cross-site scripting seriously
- 10:53XSS prevention recipe
- 11:15Avoid inline scripting risks
- 12:41Treat input as display data
- 14:05Safe URL encoding methods
- 16:59URL encoding in CSS/DOM
- 17:44Removing superpowers from script tags
- 18:49Safe static attributes
- 19:53Correct content type headers
- 20:34Safe CSS variable placement
- 21:20Defend against HTTP pollution
- 22:05Sanitize DOM content
- 22:26SRI for script integrity
- 23:08Minify and bundle securely
- 23:30Preventing cross-site request forgery
- 24:13Static analysis with linters
- 24:33Avoid dangerous functions
- 26:19Never use untrusted HTML data
- 27:02Stop prototype injection
- 28:07Same origin policy
- 29:12Server-side input validation
- 29:32Prefer private variables
- 30:14Free security tools
- 30:35Conclusion
related talks
47m30 Tips for Secure JavaScript
08mHack Proofing Your JavaScript A Fun And Engaging Guide To Enhancing Security
58mPractical Secure Development and Operations with JavaScript in 2020
38mThe Security Toolbox For Node
30m"JavaScript, the Real Bad Parts"
40mHostile JavaScript: Attacking and Defending the Browser
35mSafeguarding Large-Scale Projects: Navigating TypeScript Security Pitfalls
34mReal World JavaScript Security