1
Course Overview: Web Security Essentials
4m 17s
2
Simulate Man in the Middle Attacks and Inspect Network Traffic with Charles Proxy
3m 1s
3
Add https to a Localhost Express App to Prevent MITM Attacks
2m 33s
4
Redirect All HTTP Traffic to HTTPS in Express to Ensure All Responses are Secure
2m 19s
5
Set the Secure Cookie Flag to Ensure Cookies are Only Sent Over Secure Connections
1m 35s
6
Add HSTS Headers to Express Apps to Ensure All Requests are https Requests
4m 15s
7
Create a Proof of Concept Exploit of a CSRF Vulnerable Website
4m 1s
8
Mitigate CSRF Attacks by Setting the SameSite Cookie Flag in Express
2m 46s
9
Add CSRF Token Middleware to an Express Server to Mitigate CSRF
6m 12s
10
Make an XSS Payload to Read a Cookie from a Vulnerable Website
3m 50s
11
Set the httpOnly Cookie Flag in Express to Ensure Cookies are Inaccessible from JavaScript
1m 27s
12
Make an XSS Payload to Read document.body from a Vulnerable Website
53s
13
Prevent Inline Script Execution by Implementing Script-Src CSP Headers in Express
5m 30s
14
Read Document Content from a Vulnerable Website via Script Tag Injection in an XSS Payload
1m 11s
15
Add a Nonce Based script-src Header in Express to Only Allow Scripts that Match the Nonce
3m 7s
16
Prompt Users for Credentials from a Vulnerable Website via iframe Injection
1m 36s
17
Add a default-src CSP Header in Express to Enforce an Allowlist and Mitigate XSS
2m 15s

Add a default-src CSP Header in Express to Enforce an Allowlist and Mitigate XSS

Mike Sherov

InstructorMike Sherov

Share this video with your friends

In this lesson, we'll learn how to disable all external content srcs other than the specific types of external resources we need. For the types of external resources we need, we'll limit those resources to only nonce-matching resources. This will effectively mitigate all forms of XSS, using the principle of least power to only enable needed capabilities, and drastically reducing the surface area of possible attacks on our website.

illustration for Web Security Essentials: MITM, CSRF, and XSS

Course

Web Security Essentials: MITM, CSRF, and XSS

Nat

Nat

~ 5 years ago

Hi! Thanks for the great course! The question is why not just take care of preventing code injection with validation/sanitization of user input for XSS?

Mike Sherov

Mike Sherovinstructor

~ 5 years ago

Hi Nat! You should definitely do both validation/sanitization AND use CSP. In earlier lessons, I explain that you should always use a "defense in depth" approach to security. That is, if there are two ways to protect, do both in case one of the fails. In this case, input sanitization should always be done but it's important to recognize that it's also error prone and difficult to always do it successfully. With CSP, you get an extra layer of protection :-)

For example, see this article that describes an XSS vuln that was found in Gmail's AMP implementation but wasn't exploitable because of gmails CSP policy: https://mypc.guru/google-developers-fixed-gmail-dynamic-messaging-xss-vulnerability/

Nat

Nat

~ 5 years ago

Thanks, Mike! You've been very helpful