Under The JavaScript Bed, There's a Security Monster.

[pimterry]

Security is left for later by teams all too often, but this is especially risky for JavaScript developers; we build at speed, framework churn has created many tools more shiny than secured, and half our code runs in untrustable browser environments anyway.

In this talk we'll look at a selection of vulnerabilities that bite many JavaScript applications on the server & client side, to see how they can break your code, and what you can do about it. We'll examine the new types of XSS vulnerability that single-page app approaches create, go beyond HTTPS to truly harden your site against MitM attacks, and learn to stop our shiny tools & DBs from exposing our data to the world. JS security is tough, but there are key simple steps you can take to drastically improve your chances.