Wes Bos & Scott Tolinski - Full Stack JavaScrip...

Zpravodajství

Technologické zprávy

Technika

731: Client side security, XSS attacks & CSP with Stripe’s Alex Sexton

Syntax - Tasty Web Development Treats

Full Stack Developers Wes Bos and Scott Tolinski dive deep into web development topics, explaining how they work and talking about their own experiences. They cover from JavaScript frameworks like React, to the latest advancements in CSS to simplifying web tooling.

Scott and Wes are joined by security expert, Alex Sexton of Stripe to cover all things: client security, XSS, attack vectors, and CSP (content security policy). <h3 class="code-line" data-line-start="2" data-line-end="3"><a id= "Show_Notes_2"></a>Show Notes</h3> <ul> <li class="has-line-data" data-line-start="4" data-line-end="5"> <a href="#t=00:00">00:00</a> Welcome to Syntax!</li> <li class="has-line-data" data-line-start="5" data-line-end="6"> <a href="#t=00:31">00:31</a> Brought to you by <a href="http://Sentry.io">Sentry.io</a>.</li> <li class="has-line-data" data-line-start="6" data-line-end="7"> <a href="#t=00:57">00:57</a> Who is Alex Sexton?</li> <li class="has-line-data" data-line-start="7" data-line-end="8"> <a href="#t=04:44">04:44</a> Stripe dashboard is a work of art.</li> <li class="has-line-data" data-line-start="8" data-line-end="9"> <a href="#t=05:08">05:08</a> Tell us about the design system.</li> <li class="has-line-data" data-line-start="9" data-line-end="10"> <a href="https://react-spectrum.adobe.com/react-aria/">React Aria</a></li> <li class="has-line-data" data-line-start="10" data-line-end="11"> <a href="#t=08:59">08:59</a> Who develops the iOS app?</li> <li class="has-line-data" data-line-start="11" data-line-end="12"> <a href="#t=09:50">09:50</a> Stripe’s CSP (content security policy).</li> <li class="has-line-data" data-line-start="12" data-line-end="13"> <a href="#t=12:50">12:50</a> What even is a content security policy?</li> <li class="has-line-data" data-line-start="13" data-line-end="14"> <a href="https://www.youtube.com/watch?v=JbfNWg6JS4U">Content Security Policy explanation</a></li> <li class="has-line-data" data-line-start="14" data-line-end="15"> <a href="#t=13:57">13:57</a> Douglas Crockford of Yahoo on security.</li> <li class="has-line-data" data-line-start="15" data-line-end="16"> <a href="https://github.com/douglascrockford">Douglas on GitHub</a></li> <li class="has-line-data" data-line-start="16" data-line-end="17"> <a href="#t=15:13">15:13</a> Security philosophy.</li> <li class="has-line-data" data-line-start="17" data-line-end="18"> <a href="#t=16:59">16:59</a> What about inline styles and inline JavaScript?</li> <li class="has-line-data" data-line-start="18" data-line-end="19"> <a href="#t=19:41">19:41</a> How do we safely set inline styles from JS?</li> <li class="has-line-data" data-line-start="19" data-line-end="20"> <a href="#t=20:20">20:20</a> Setting up with meta tags.</li> <li class="has-line-data" data-line-start="20" data-line-end="21"> <a href="#t=22:52">22:52</a> What are common situations that require security exceptions?</li> <li class="has-line-data" data-line-start="21" data-line-end="22"> <a href="#t=26:24">26:24</a> Potential damage with inline style tags.</li> <li class="has-line-data" data-line-start="22" data-line-end="23"> <a href="#t=32:45">32:45</a> Looping vulnerabilities.</li> <li class="has-line-data" data-line-start="23" data-line-end="24"> <a href="#t=36:32">36:32</a> What about JavaScript injection?</li> <li class="has-line-data" data-line-start="24" data-line-end="25"> <a href="#t=37:09">37:09</a> Myspace Samy Worm.</li> <li class="has-line-data" data-line-start="25" data-line-end="26"> <a href= "https://en.wikipedia.org/wiki/Samy_(computer_worm)">Myspace Samy Worm Wiki</a></li> <li class="has-line-data" data-line-start="26" data-line-end="27"> <a href= "https://docs.sentry.io/product/security-policy-reporting/">Sentry.io Security Policy Reporting</a></li> <li class="has-line-data" data-line-start="27" data-line-end="28"> <a href="#t=42:02">42:02</a> Does a CSP stop code from running in the console?</li> <li class="has-line-data" data-line-start="28" data-line-end="29"> <a href="#t=43:28">43:28</a> What are some general security best practices?</li> <li class="has-line-data" data-line-start="29" data-line-end="30"> <a href="#t=46:35">46:35</a> Strategies for rolling out a CSP.</li> <li class="has-line-data" data-line-start="30" data-line-end="31"> <a href="#t=51:49">51:49</a> Final tip, Strict Dynamic.</li> <li class="has-line-data" data-line-start="31" data-line-end="32"> <a href= "https://content-security-policy.com/strict-dynamic/">Strict Dynamic</a></li> <li class="has-line-data" data-line-start="32" data-line-end="33"> <a href="#t=56:36">56:36</a> Where does the CSP live within Stripe?</li> <li class="has-line-data" data-line-start="33" data-line-end="34"> <a href="https://stripe.com/en-ca/newsroom/news/bfcm2023">Original Black Friday story</a></li> <li class="has-line-data" data-line-start="34" data-line-end="35"> <a href="#t=59:35">59:35</a> One last story.</li> <li class="has-line-data" data-line-start="35" data-line-end="36"> <a href="#t=01:01:20">01:01:20</a> Sick Picks + Shameless Plugs</li> </ul> <h3 class="code-line" data-line-start="38" data-line-end="39"> <a id="Sick_Picks__Shameless_Plugs_38"></a>Sick Picks + Shameless Plugs</h3> <ul> <li class="has-line-data" data-line-start="40" data-line-end="42"> Alex: <a href="https://www.instagram.com/wesbos/">Wes Bos’ Instagram</a></li> </ul> <h3 class="code-line" data-line-start="42" data-line-end="43"> <a id="Hit_us_up_on_Socials_42"></a>Hit us up on Socials!</h3> Syntax: <a href="https://twitter.com/syntaxfm">X</a> <a href= "https://www.instagram.com/syntax_fm/">Instagram</a> <a href= "https://www.tiktok.com/@syntaxfm">Tiktok</a> <a href= "https://www.linkedin.com/company/96077407/admin/feed/posts/">LinkedIn</a> <a href="https://www.threads.net/@syntax_fm">Threads</a> Wes: <a href="https://twitter.com/wesbos">X</a> <a href= "https://www.instagram.com/wesbos/">Instagram</a> <a href= "https://www.tiktok.com/@wesbos">Tiktok</a> <a href= "https://www.linkedin.com/in/wesbos/">LinkedIn</a> <a href= "https://www.threads.net/@wesbos">Threads</a> Scott:<a href="https://twitter.com/stolinski">X</a> <a href= "https://www.instagram.com/stolinski/">Instagram</a> <a href= "https://www.tiktok.com/@stolinski">Tiktok</a> <a href= "https://www.linkedin.com/in/stolinski/">LinkedIn</a> <a href= "https://www.threads.net/@stolinski">Threads</a> Randy: <a href="https://twitter.com/randyrektor">X</a> <a href= "https://www.instagram.com/randyrektor/">Instagram</a> <a href= "https://www.youtube.com/@randyrektor">YouTube</a> <a href= "https://www.threads.net/@randyrektor">Threads</a>

Scott and Wes are joined by security expert, Alex Sexton of Stripe to cover all things: client security, XSS, attack vectors, and CSP (content security policy).
 Show Notes  00:00 Welcome to Syntax!
 00:31 Brought to you by Sentry.io.
 00:57 Who is Alex Sexton?
 04:44 Stripe dashboard is a work of art.
 05:08 Tell us about the design system.
 React Aria

 08:59 Who develops the iOS app?
 09:50 Stripe’s CSP (content security policy).
 12:50 What even is a content security policy?
 Content Security Policy explanation

 13:57 Douglas Crockford of Yahoo on security.
 Douglas on GitHub

 15:13 Security philosophy.
 16:59 What about inline styles and inline JavaScript?
 19:41 How do we safely set inline styles from JS?
 20:20 Setting up with meta tags.
 22:52 What are common situations that require security exceptions?
 26:24 Potential damage with inline style tags.
 32:45 Looping vulnerabilities.
 36:32 What about JavaScript injection?
 37:09 Myspace Samy Worm.
 Myspace Samy Worm Wiki

 Sentry.io Security Policy Reporting

 42:02 Does a CSP stop code from running in the console?
 43:28 What are some general security best practices?
 46:35 Strategies for rolling out a CSP.
 51:49 Final tip, Strict Dynamic.
 Strict Dynamic

 56:36 Where does the CSP live within Stripe?
 Original Black Friday story

 59:35 One last story.
 01:01:20 Sick Picks + Shameless Plugs
  Sick Picks + Shameless Plugs  Alex: Wes Bos’ Instagram

  Hit us up on Socials! Syntax: X Instagram Tiktok LinkedIn Threads
 Wes: X Instagram Tiktok LinkedIn Threads
 Scott:X Instagram Tiktok LinkedIn Threads
 Randy: X Instagram YouTube Threads

Aplikace Youradio Talk

731: Client side security, XSS attacks & CSP with Stripe’s Alex Sexton

Poslechněte si podcast