WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
World Congress 2024 • Aug 20, 2024 • Session details

Cross Site Scripting is yesterday's news, isn't it?

martinakraus

Think modern frameworks cured XSS? They haven't. Learn how to lock down your application against native DOM bypasses using strict CSPs and Trusted Types.

Pause
Mute Enter Fullscreen
#1 about 2 min

Demonstrating cross-site scripting in an Angular application

How stored cross-site scripting manifests through unsanitized application input fields.

#2 about 4 min

How native DOM APIs bypass framework sanitization

Why built-in sanitizers in modern frameworks are bypassed when using native DOM properties directly.

#3 about 4 min

Configuring content security policy directives and modes

A foundational overview of Content Security Policy enforcement, report-only operations, and default behavior directives.

#4 about 5 min

Implementing basic CSP and restricting unsafe inline elements

Applying a basic Content Security Policy to block malicious scripts while configuring specific style allowances.

#5 about 3 min

Securing specific inline JavaScript blocks using CSP hashes

Generating and applying SHA checksum hashes to safely execute known inline JavaScript logic.

#6 about 8 min

Using CSP nonces and strict-dynamic for complex applications

Implementing server-side rendered cryptographic nonces alongside strict-dynamic configurations to securely propagate script execution trust.

#7 about 2 min

Supply chain security risks in NPM dependency code

Why traditional Content Security Policies fail to protect against vulnerabilities originating from third-party NPM packages.

#8 about 2 min

Enforcing safe HTML assignments using Trusted Types policies

Adopting the emerging Trusted Types specification as a structurally robust mitigation for DOM-based cross-site scripting.

#9 about 4 min

Generating Trusted Types safely using the DOMPurify library

Implementing the DOMPurify sanitizer software to automatically return compliant Trusted Types without writing flawed custom logic.

Matching moments

1:05 min

Handling modern injection flaws and cross-site scripting

Christian Wenz Christian Wenz · World Congress 2026 Europe

1:35 min

Enhancing core browser security with the native HTML Sanitizer API

Chris Heilmann +2 · LIVE

1:44 min

Evaluating framework architectures against cross-site scripting attack vectors

Philippe De Ryck · LIVE

4:58 min

Dealing with cross-site scripting in single page applications

Thomas Konrad · LIVE

1:43 min

Stopping cross-site scripting attacks via secure HTML types

Michael Koppmann · LIVE

2:07 min

Understanding classic XSS risks in reactive frontend frameworks

Ramona Schwering Ramona Schwering · World Congress 2026 Europe

More from World Congress 2024

Beyond the Hype: Real-World AI Strategies Panel thumbnail
24:07
12 months ago

Beyond the Hype: Real-World AI Strategies Panel

Mike Butcher, Jürgen Müller, Katrin Lehmann, Tobias Regenfuss

Carl Lapierre - Exploring Advanced Patterns in Retrieval-Augmented Generation thumbnail
21:17
almost 2 years ago

Carl Lapierre - Exploring Advanced Patterns in Retrieval-Augmented Generation

Carl Lapierre

Coding an Immersive Copilot using Unity / .NET and Azure OpenAI! thumbnail
31:50
about 2 years ago

Coding an Immersive Copilot using Unity / .NET and Azure OpenAI!

Zaid Zaim

Building a diverse tech company: The power of Diversity, Equity, Inclusion, and Belonging thumbnail
29:43
about 2 years ago

Building a diverse tech company: The power of Diversity, Equity, Inclusion, and Belonging

Sue Quackenbush

Dapr in Practice thumbnail
24:08
about 2 years ago

Dapr in Practice

marcklefter

Minimising the Carbon Footprint of Workloads thumbnail
27:46
about 2 years ago

Minimising the Carbon Footprint of Workloads

Michael Mueller

Upcoming sessions on this topic

Open session

World Congress 2026 North America

September 25, 2026 · 16:15–16:25

Outdoor Stage

Silent Execution: Defending Against Install-Time Supply Chain Attacks

Chris DeMars

Senior Developer Advocate at TuxCare

Chris DeMars
Open session

World Congress 2026 North America

September 24, 2026 · 12:50–13:20

Stage 7

Architecting Agentic Apps: WebMCP, A2UI, and Agent Experience

Ankita Sood

Sr. Principal Engineer @ Secureworks | Angular GDE

Ankita Sood
Open session

World Congress 2026 North America

September 25, 2026 · 09:40–10:10

Stage 5

Secure-by-Inclusion: Preventing Accessibility Barriers from Becoming Security Vulnerabilities

Radostina (Ina) Tsvetkova

Norwegian Directorate of Labour and Welfare (NAV), Senior Advisor in Digital Accessibility and Inclusive Design

Radostina (Ina) Tsvetkova
Open session

World Congress 2026 North America

September 24, 2026 · 14:50–15:20

Stage 1

The Era of Machine-Driven Defense is Here: Headless Security

Loris Degioanni

Founder & CTO of Sysdig

Loris Degioanni
Open session

World Congress 2026 North America

September 24, 2026 · 14:10–14:40

Stage 2

Know Your Enemies: Live Exploit of a PHP Engine Security Breach

Alexandre Daubois

CTO of Les-Tilleuls.coop / Symfony Core Team / PHP & FrankenPHP Core Maintainer

Alexandre Daubois
Open session

World Congress 2026 North America

September 25, 2026 · 12:30–14:30

Stage 13

Docker sandboxes: protect your secrets, tokens, and personal data from AI agent mistakes

Kristiyan Velkov

Developer Relations Engineer at Zerops.io

Kristiyan Velkov

Related videos

A Primer in Single Page Application Security (Angular, React, Vue.js) thumbnail
36:39
LIVE • almost 6 years ago

A Primer in Single Page Application Security (Angular, React, Vue.js)

Thomas Konrad

Securing Frontend Applications with Trusted Types thumbnail
45:19
LIVE • over 4 years ago

Securing Frontend Applications with Trusted Types

Philippe De Ryck

101 Typical Security Pitfalls thumbnail
28:41
World Congress 2022 • over 4 years ago

101 Typical Security Pitfalls

Alexander Pirker

Security in modern Web Applications - OWASP to the rescue! thumbnail
26:59
World Congress 2023 • almost 3 years ago

Security in modern Web Applications - OWASP to the rescue!

Jakub Andrzejewski

Dangerous Reactivity: Why AI Output Is the New XSS thumbnail
23:44
World Congress 2026 Europe • 3 months ago

Dangerous Reactivity: Why AI Output Is the New XSS

Ramona Schwering

WeAreDevelopers LIVE – Spicy Vanilla Web, CSS Magic & More thumbnail
59:40
LIVE • 11 months ago

WeAreDevelopers LIVE – Spicy Vanilla Web, CSS Magic & More

Chris Heilmann, Daniel Cranney, Peter Kröner

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.