Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Hacking Front-End Apps
Search
Alex Sexton
February 12, 2014
Technology
3
2.4k
Hacking Front-End Apps
My talk on client side web security as given at the jQuery Conference 2014 in San Diego
Alex Sexton
February 12, 2014
Tweet
Share
More Decks by Alex Sexton
See All by Alex Sexton
Your Very Own Component Library
slexaxton
5
740
Front-End Ops - jQuery Conf Chicago 2014
slexaxton
1
1k
Practicing Safe Script
slexaxton
18
2.9k
Other Decks in Technology
See All in Technology
Trust as Infrastructure
bcantrill
0
180
コンテキストエンジニアリングとは? 考え方と応用方法
findy_eventslides
4
820
LLMアプリケーション開発におけるセキュリティリスクと対策 / LLM Application Security
flatt_security
7
1.5k
そのグラフに「魂」は宿っているか? ~生成AI全盛期におけるデータ可視化手法とライブラリ比較~
negi111111
2
840
WebアプリケーションのUI構築で気を付けてるポイント
tomokusaba
0
180
AI Agentと MCP Serverで実現する iOSアプリの 自動テスト作成の効率化
spiderplus_cb
0
290
AI×Data×SaaS×Operation
sansantech
PRO
0
110
Flaky Testへの現実解をGoのプロポーザルから考える | Go Conference 2025
upamune
1
300
入門 FormObject / An Introduction to FormObject #kaigionrails
expajp
2
1.4k
API提供者のためのMCPサーバー設計ガイド / MCP Server Design Guide for API Providers
yokawasa
0
240
避けられないI/O待ちに対処する: Rails アプリにおけるSSEとasync gemの活用 / Tackling Inevitable I/O Latency in Rails Apps with SSE and the async gem
moznion
2
1.8k
analysis パッケージの仕組みの上でMulti linter with configを実現する / Go Conference 2025
k1low
1
240
Featured
See All Featured
The Cost Of JavaScript in 2023
addyosmani
53
9k
Design and Strategy: How to Deal with People Who Don’t "Get" Design
morganepeng
132
19k
Creating an realtime collaboration tool: Agile Flush - .NET Oxford
marcduiker
32
2.2k
JavaScript: Past, Present, and Future - NDC Porto 2020
reverentgeek
52
5.6k
[Rails World 2023 - Day 1 Closing Keynote] - The Magic of Rails
eileencodes
36
2.5k
Writing Fast Ruby
sferik
629
62k
実際に使うSQLの書き方 徹底解説 / pgcon21j-tutorial
soudai
PRO
188
55k
GitHub's CSS Performance
jonrohan
1032
460k
The Straight Up "How To Draw Better" Workshop
denniskardys
237
140k
Performance Is Good for Brains [We Love Speed 2024]
tammyeverts
12
1.1k
Chrome DevTools: State of the Union 2024 - Debugging React & Beyond
addyosmani
7
880
Rails Girls Zürich Keynote
gr2m
95
14k
Transcript
Hacking Front-End Apps Alex Sexton
I work at .
which is in . California
but…
I live in . Texas
The web has a lot in common with Texas.
“The wild west.”
In 1985, Texas had a problem.
None
Littering
Some Texans defended their “God-given right to litter.”
ಠ_ಠ
There were fines for littering.
photo by Curtis Gregory Perry
But no one seemed to care.
The state tried some slogans.
None
But these slogans apparently did not resonate with the core
offenders
Males 18-24 “Bubbas in Pickup Trucks”
In 1985 Texas tried a new campaign:
None
The campaign reduced litter on Texas highways ! 72% !
from 1986 to 1990.
My point is…
“Hey everyone, you should make your websites more secure because
it’s important.” ! Probably isn’t going to do the trick.
DON’T! MESS! WITH! XSS Also probably won’t work.
Web developers, not security researchers, are the core audience.
Web security is hard.
“All you have to do is never make a single
mistake.” - I Think Mike West
“I discount the probability of perfection.” - Alex Russell
Content Injection
None
None
None
Everyone has a friend that always seems to pick “<script>alert(‘hacked!’);</script>”
as their username.
My User Agent
My Friend, Mike Taylor’s User Agent Mozilla/5.0 (Macintosh; Intel Mac
OS X 10.9; rv:25.0) <script>alert(‘lol’);</script> Gecko/20100101 Firefox/25.0
My Friend, Mike Taylor’s User Agent Mozilla/5.0 (Macintosh; Intel Mac
OS X 10.9; rv:25.0) <script>alert(‘lol’);</script> Gecko/20100101 Firefox/25.0
ಠ_ಠ
Samy
None
None
None
ಠ_ಠ
So let’s just detect malicious scripts!
None
alert(1)
The Billy Hoffman Whitespace Attack <script> ! </script>
The Billy Hoffman Whitespace Attack <script> ! </script> Malicious
Code
The Billy Hoffman Whitespace Attack <script> ! </script> tab
tab tab space space
The Billy Hoffman Whitespace Attack <script> ! </script> 1
1 1 0 0
You cannot detect malicious code.
output.replace(/<script>/, ‘’);
CSS Hacks
Old School
None
Link Visited Link getComputedStyle( getComputedStyle( ) ) === \o\|o|/o/ Pretty
much People Celebrating (or screaming on fire)
Timing Attacks
Security by Inaccuracy
requestAnimationFrame + :visited = ಠ_ಠ
requestAnimationFrame + :visited = ಠ_ಠ
requestAnimationFrame + :visited = ಠ_ಠ
Link Visited Link
Link Visited Link <16ms >60ms Time to render
JSON-P
MORE LIKE JSON-Pretty-Insecure
“I’d really like it if someone could run arbitrary dynamic
scripts on my page” - JSONP Users
You wouldn’t do this.
So don’t do this.
A Leak In The Response
YouProbablyShouldUseCORS.tumblr.com
enable-cors.org
Try to say CROSS SITE! REQUEST FORGERY 5 times fast.
Set-Cookie ‘csrf=0003’
Set-Cookie ‘csrf=0003’
None
None
None
It gets worse.
Contextis White Paper
Cross-Domain Data Snooping via SVG Filters and OCR
None
ಠ_ಠ
We need a new approach.
Content Security Policy
None
Disallow Inline JS, CSS By Default!
Disallow eval By Default!
Disallow Cross Domain JS, CSS, IMG, Fonts
Report Violations!
None
A White List That’s the key!
Good Security Goes Beyond Content Injection
<iframe sandbox>
HTTPS Everywhere
HTTPS Everywhere
HTTPS Only
301 Redirect http
https HSTS
Frame Busting
Disallow as an iFrame X-Frame-Options
It’s “security by default.” At least much closer…
You can rely a little less on being perfect.
it only matters if everyone buys in. But
We need our own slogan.
We need developers to take pride in making secure applications.
Don’t Mess With The Web
ಠ_ಠ
Let’s do something about it together.
Thanks! @SlexAxton Special Thanks To: Mike West * 1000 Adam
Baldwin Contextis MDN