WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
World Congress 2024 • Aug 29, 2024 • Session details

It's a (testing) trap! - Common testing pitfalls and how to solve them

Ramona Schwering

Your end-to-end tests are secretly your best security tools. Discover how to repurpose Cypress and Playwright into automated defenders against critical OWASP vulnerabilities.

Pause
Mute Enter Fullscreen
#1 about 6 min

Conceptualizing app security defense using gaming mechanics

Visualizing web application vulnerabilities and their mitigation measures through the strategic mechanics of tower defense games.

#2 about 2 min

Identifying common security vulnerabilities via the OWASP project

Prioritizing testing efforts by referencing open source analytics that define the most prevalent and hazardous internet threats.

#3 about 2 min

Isolating cross-site scripting issues using automated component tests

Simulating adversarial behavior by injecting script payloads into test inputs to ensure interfaces properly discard dangerous strings.

#4 about 4 min

Verifying API response rules and content security policy

Requesting forbidden actions and capturing header objects with robust tooling to check resource permissions and distinct origin validation.

#5 about 2 min

Defending against broken access control with negative testing

Covering expected authentication paths alongside intentional negative workflows to ensure private zones adequately reject unauthenticated queries.

#6 about 1 min

Executing fundamental runtime tests against cryptographic failures

Safeguarding data transit efficiently by configuring natively bundled test framework routines to explicitly fail on unencrypted connections.

#7 about 4 min

Addressing unseen code weaknesses using complementary security pipelines

Integrating standard static analysis tooling alongside codebase scanning extensions to protect backend components beyond generic end-to-end constraints.

#8 about 4 min

Deploying structural security analysis within general testing workflows

Building a comprehensive quality assurance pipeline by prioritizing typical vulnerabilities before systematically enforcing broad automated constraints.

#9 about 3 min

Bolstering test coverage consistently without specialized security frameworks

Defending expansive application requirements practically by executing simplified interactions alongside designated internal architectural mitigations.

#10 about 1 min

Encouraging broader team adoption of security automation practices

Protecting continuous delivery and developer focus by permanently migrating repeated manual vulnerability checks into scheduled automated pipeline routines.

Matching moments

2:33 min

Introduction to security advocacy and automation testing

Chris Heilmann Chris Heilmann +2 · LIVE

4:19 min

Plants vs zombies as an analogy for web security

Ramona Schwering Ramona Schwering · LIVE

2:10 min

Summary of security testing strategies and best practices

Ramona Schwering Ramona Schwering · LIVE

4:00 min

Evolution from manual hacking to automated security testing

Chris Wysopal Chris Wysopal · World Congress 2024

2:39 min

Shifting security testing focus toward critical application logic problems

Julian Totzek-Hallhuber Julian Totzek-Hallhuber · World Congress 2026 Europe

4:48 min

Using intentionally vulnerable applications for practical security training

Bozidar Spirovski Bozidar Spirovski +1 · Coffee With Developers

More from World Congress 2024

Beyond the Hype: Real-World AI Strategies Panel thumbnail
24:07
about 1 year ago

Beyond the Hype: Real-World AI Strategies Panel

Mike Butcher, Jürgen Müller, Katrin Lehmann, Tobias Regenfuss

Carl Lapierre - Exploring Advanced Patterns in Retrieval-Augmented Generation thumbnail
21:17
almost 2 years ago

Carl Lapierre - Exploring Advanced Patterns in Retrieval-Augmented Generation

Carl Lapierre

Coding an Immersive Copilot using Unity / .NET and Azure OpenAI! thumbnail
31:50
about 2 years ago

Coding an Immersive Copilot using Unity / .NET and Azure OpenAI!

Zaid Zaim

Building a diverse tech company: The power of Diversity, Equity, Inclusion, and Belonging thumbnail
29:43
about 2 years ago

Building a diverse tech company: The power of Diversity, Equity, Inclusion, and Belonging

Sue Quackenbush

Livecoding with AI thumbnail
31:39
about 2 years ago

Livecoding with AI

Rainer Stropek

Dapr in Practice thumbnail
24:08
about 2 years ago

Dapr in Practice

marcklefter

Upcoming sessions on this topic

Open session

Supply Chain Security for the Everyday Engineer

  • Pradumna Saraf

    Kestra Technologies

    Quality Assurance Engineer

Open session

What I Got Wrong Shipping an MCP Server for Live Infrastructure

  • Pritesh Kiri

    Harness

    Developer Relations Engineer

Open session

Beware of Strangers Bearing Code: Open Source Trust in the Agent Era

  • Vikram Vaswani

    Consultant

Open session

Teaching AI Coding Agents to Build It Right the First Time

  • Sajeetharan Sinnathurai

    Microsoft

    Principal Product Manager

Open session

Autopsy of an Autonomous Incident: When the Agent Made It Worse

  • Navin Pai

    StackGen

    Director of Engineering

Open session

How We Cut Our API's p99 Latency from Minutes to Under a Second

  • Deepak Agrawal

    Atlassian

    Principal Software Engineer

Related videos

Plants vs. Thieves: Automated Tests in the World of Web Security thumbnail
24:09
LIVE • almost 2 years ago

Plants vs. Thieves: Automated Tests in the World of Web Security

Ramona Schwering

Software Security 101: Secure Coding Basics thumbnail
1:58:48
World Congress 2021 • over 5 years ago

Software Security 101: Secure Coding Basics

Thomas Konrad

Securing Your Web Application Pipeline From Intruders thumbnail
44:30
LIVE • almost 6 years ago

Securing Your Web Application Pipeline From Intruders

Milecia Mcgregor

Spot, Squash, Secure: Fighting Security Bugs with GitHub Copilot thumbnail
22:56
World Congress 2026 Europe • 3 months ago

Spot, Squash, Secure: Fighting Security Bugs with GitHub Copilot

Malte Lantin, Marie Theresa Brosig

What The Hack is Web App Sec? thumbnail
24:01
Coffee With Developers • over 1 year ago

What The Hack is Web App Sec?

Jackie

Simple Steps to Kill DevSec without Giving Up on Security thumbnail
21:53
World Congress 2025 • about 1 year ago

Simple Steps to Kill DevSec without Giving Up on Security

Isaac Evans

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.