Wes Bos & Scott Tolinski - Full Stack JavaScript Web Developers

Zpravodajství

Technologické zprávy

Technika

Hasty Treat - Front End Security

Syntax - Tasty Web Development Treats

Full Stack Developers Wes Bos and Scott Tolinski dive deep into web development topics, explaining how they work and talking about their own experiences. They cover from JavaScript frameworks like React, to the latest advancements in CSS to simplifying web tooling.

<p>In this Hasty Treat, Scott and Wes talk about front end security and what to do in order to avoid hacking.</p> <h2><a id="Sentry__Sponsor_9" name="Sentry__Sponsor_9"></a>Sentry - Sponsor</h2> <p>If you want to know what’s happening with your errors, track them with <a href="https://sentry.io/">Sentry</a>. Sentry is open-source error tracking that helps developers monitor and fix crashes in real time. Cut your time on error resolution from five hours to five minutes. It works with any language and integrates with dozens of other services. Syntax listeners can get two months for free by visiting <a href= "https://sentry.io/">Sentry</a> and using the coupon code “tastytreat”.</p> <h2><a id="Show_Notes_13" name="Show_Notes_13"></a>Show Notes</h2> <p>2:53 - SSL</p> <ul> <li>Encrypted transfer of information</li> <li>Digitally binds a cryptographic key to an organization’s details</li> <li>Web-cam, geolocation, etc.</li> </ul> <p>6:15 - innerHTML</p> <ul> <li>React’s dangerouslySetInnerHTML <ul> <li>Name intentionally chosen to be frightening</li> <li>Allows you to write HTML to the DOM</li> <li>Data should be sanitized before used in prop <ul> <li>Removes unexpected data from string</li> <li>Used to prevent cross site scripting attacks</li> </ul> </li> </ul> </li> </ul> <p>10:25 - Don’t trust the client</p> <ul> <li>The client can be manipulated to send any info to your server</li> <li>E-commerce example — don’t take the price total from the front end to make the charge, DB call and calculate on the server</li> <li>Validate form inputs via HTML 5 field validation/check data types on the server <ul> <li>Don’t allow your users to send an object when it should just be a string</li> <li>Get this for free with GraphQL via types</li> </ul> </li> </ul> <p>13:41 - PCI Compliance</p> <ul> <li>Protect card holder data <ul> <li>SSL or Secure iFrame</li> </ul> </li> <li>Encrypt transmission of card data</li> <li>Restrict access to card holder data</li> <li>Restrict physical access <ul> <li>Front of front-end</li> </ul> </li> </ul> <p>16:44 - Tips</p> <ul> <li>Don’t put a name on sensitive fields if you are using JS</li> <li>HTTP only cookies</li> <li>Local Storage tokens</li> <li>XSS</li> </ul> <h2><a id="Links_54" name="Links_54"></a>Links</h2> <ul> <li><a href="https://reactjs.org/">React</a></li> <li><a href="https://graphql.org/">GraphQL</a></li> <li><a href="https://expressjs.com/">Express</a></li> </ul> <h2><a id="Tweet_us_your_tasty_treats_59" name= "Tweet_us_your_tasty_treats_59"></a>Tweet us your tasty treats!</h2> <ul> <li><a href="https://www.instagram.com/stolinski/">Scott’s Instagram</a></li> <li><a href= "https://www.instagram.com/LevelUpTutorials/">LevelUpTutorials Instagram</a></li> <li><a href="https://www.instagram.com/wesbos/">Wes’ Instagram</a></li> <li><a href="https://twitter.com/wesbos">Wes’ Twitter</a></li> <li><a href="https://www.facebook.com/wesbos.developer">Wes’ Facebook</a></li> <li><a href="https://twitter.com/stolinski">Scott’s Twitter</a></li> <li>Make sure to include <a href= "https://twitter.com/SyntaxFM">@SyntaxFM</a> in your tweets</li> </ul>

In this Hasty Treat, Scott and Wes talk about front end security and what to do in order to avoid hacking.
 Sentry - Sponsor If you want to know what’s happening with your errors, track them with Sentry. Sentry is open-source error tracking that helps developers monitor and fix crashes in real time. Cut your time on error resolution from five hours to five minutes. It works with any language and integrates with dozens of other services. Syntax listeners can get two months for free by visiting Sentry and using the coupon code “tastytreat”.
 Show Notes 2:53 - SSL
 Encrypted transfer of information
 Digitally binds a cryptographic key to an organization’s details
 Web-cam, geolocation, etc.
 6:15 - innerHTML
 React’s dangerouslySetInnerHTML Name intentionally chosen to be frightening
 Allows you to write HTML to the DOM
 Data should be sanitized before used in prop Removes unexpected data from string
 Used to prevent cross site scripting attacks

 10:25 - Don’t trust the client
 The client can be manipulated to send any info to your server
 E-commerce example — don’t take the price total from the front end to make the charge, DB call and calculate on the server
 Validate form inputs via HTML 5 field validation/check data types on the server Don’t allow your users to send an object when it should just be a string
 Get this for free with GraphQL via types

 13:41 - PCI Compliance
 Protect card holder data SSL or Secure iFrame

 Encrypt transmission of card data
 Restrict access to card holder data
 Restrict physical access Front of front-end

 16:44 - Tips
 Don’t put a name on sensitive fields if you are using JS
 HTTP only cookies
 Local Storage tokens
 XSS
 Links React
 GraphQL
 Express
 Tweet us your tasty treats! Scott’s Instagram
 LevelUpTutorials Instagram
 Wes’ Instagram
 Wes’ Twitter
 Wes’ Facebook
 Scott’s Twitter
 Make sure to include @SyntaxFM in your tweets

Aplikace Youradio Talk

Hasty Treat - Front End Security

Poslechněte si podcast