WeAreDevelopers Logo WeAreDevelopers
Sign in
For You LIVE
World Congress 2023 • Sep 27, 2023

Security in modern Web Applications - OWASP to the rescue!

Jakub Andrzejewski

Frontend developers are now the first line of defense against cyberattacks. Automate your security baseline using OWASP standards and zero-config middlewares to make your application too difficult to break.

Pause
Mute Enter Fullscreen
#1 about 3 min

Shift of security responsibilities to frontend developers

The transition to full-stack frameworks shifts security boundaries previously handled by backend teams directly to the frontend.

#2 about 3 min

Prioritizing security over rapid feature delivery

Balancing fast development cycles with robust security requires clear communication and realistic project estimations.

#3 about 3 min

Implementing OWASP top 10 guidelines early

Integrating the OWASP baseline guidelines into continuous integration pipelines ensures earlier vulnerability detection.

#4 about 3 min

Understanding common web application vulnerabilities and risks

Threat actors continually exploit implementation flaws like SQL injections and broken access control to compromise user data.

#5 about 4 min

Mitigating dependency confusion in NPM packages

Preventing software supply chain attacks requires dependency scanning tools and strict validation of private registry resolutions.

#6 about 4 min

Securing applications with HTTP response headers

Native browser configurations like content security policies prevent cross-site flaws in both dynamic and static architectures.

#7 about 5 min

Configuring the framework security module for Nuxt

Using dedicated framework plugins automates request size limits, geolocation blocking, and API rate limiting capabilities.

#8 about 4 min

Introducing the Next.js security module port

Expanding default HTTP protection rules to the React ecosystem requires adapting middleware patterns for data fetching.

#9 about 3 min

Handling server headers and LLM injections

While static sites rely on meta tags for browser instructions, setting security headers directly on the web server remains the most robust defense.

Matching moments

1:05 min

Handling modern injection flaws and cross-site scripting

Christian Wenz Christian Wenz · World Congress 2026 Europe

2:19 min

Evaluating emerging CSS features and package manager security

Chris Heilmann +2 · LIVE

3:07 min

Implementing zero trust security practices in frontend applications

Jan Peer Stöcklmair Jan Peer Stöcklmair · World Congress 2026 Europe

6:43 min

Implementing seven essential steps for modern web security

Bartosz Pietrucha · JS Congress

1:44 min

Evaluating framework architectures against cross-site scripting attack vectors

Philippe De Ryck · LIVE

3:26 min

Q&A: Codebase footprint and native application security

Avichay Eyal · World Congress 2021

More from World Congress 2023

The year 3000, a brief history of Web Development thumbnail
25:30
over 2 years ago

The year 3000, a brief history of Web Development

Lorenzo Pieri

Demografie nutzen um jedem Bewerber das passende Angebot zu machen! thumbnail
8:52
almost 3 years ago

Demografie nutzen um jedem Bewerber das passende Angebot zu machen!

Nathalie Gierth

Guided Memory Management: Rust's Ownership Model thumbnail
0:18
almost 3 years ago

Guided Memory Management: Rust's Ownership Model

Stefan Baumgartner

Passwordless future: WebAuthn and Passkeys in practice thumbnail
32:32
almost 3 years ago

Passwordless future: WebAuthn and Passkeys in practice

Clemens Hübner

External Secrets Operator: the secrets management toolbox for self-sufficient teams thumbnail
30:07
almost 3 years ago

External Secrets Operator: the secrets management toolbox for self-sufficient teams

Moritz Johner

Building Reliable Serverless Applications with AWS CDK and Testing thumbnail
25:18
almost 3 years ago

Building Reliable Serverless Applications with AWS CDK and Testing

Raphael Manke

Upcoming sessions on this topic

Open session

World Congress 2026 North America

September 24, 2026 · 14:50–15:20

Stage 1

The Era of Machine-Driven Defense is Here: Headless Security

Loris Degioanni

Founder & CTO of Sysdig

Loris Degioanni
Open session

World Congress 2026 North America

September 25, 2026 · 09:40–10:10

Stage 5

Secure-by-Inclusion: Preventing Accessibility Barriers from Becoming Security Vulnerabilities

Radostina (Ina) Tsvetkova

Norwegian Directorate of Labour and Welfare (NAV), Senior Advisor in Digital Accessibility and Inclusive Design

Radostina (Ina) Tsvetkova
Open session

World Congress 2026 North America

September 25, 2026 · 15:00–17:00

Stage 12

Secure development from pull request to production with GitHub

Sam Jarvinen

Senior Solutions Engineer, GitHub

Sam Jarvinen
Open session

World Congress 2026 North America

September 25, 2026 · 13:30–14:00

Stage 9

On the Public Clock: Open-Source Defense When You're Not in the Club

Nicholas Muy

VP Engineering Platform and Security at Scrut.io

Nicholas Muy
Open session

World Congress 2026 North America

September 25, 2026 · 09:00–09:30

Stage 4

Don’t kill my Vibes - Simple Steps to Stay Secure when Vibe Coding

Isaac Evans

Founder & CEO of Semgrep

Isaac Evans
Open session

World Congress 2026 North America

September 24, 2026 · 14:10–14:40

Stage 2

Know Your Enemies: Live Exploit of a PHP Engine Security Breach

Alexandre Daubois

CTO of Les-Tilleuls.coop / Symfony Core Team / PHP & FrankenPHP Core Maintainer

Alexandre Daubois

Related videos

Bulletproof Web Applications: The 2025 OWASP Top Ten thumbnail
25:29
World Congress 2026 Europe • 2 months ago

Bulletproof Web Applications: The 2025 OWASP Top Ten

Christian Wenz

A Primer in Single Page Application Security (Angular, React, Vue.js) thumbnail
36:39
LIVE • almost 6 years ago

A Primer in Single Page Application Security (Angular, React, Vue.js)

Thomas Konrad

Software Security 101: Secure Coding Basics thumbnail
1:58:48
World Congress 2021 • about 5 years ago

Software Security 101: Secure Coding Basics

Thomas Konrad

Bullet-Proof APIs: The OWASP API Security Top Ten thumbnail
25:46
World Congress 2025 • about 1 year ago

Bullet-Proof APIs: The OWASP API Security Top Ten

Christian Wenz

Stranger Danger: Your Java Attack Surface Just Got Bigger thumbnail
1:58:59
LIVE • over 4 years ago

Stranger Danger: Your Java Attack Surface Just Got Bigger

Vandana Verma Sehgal

Cross Site Scripting is yesterday's news, isn't it? thumbnail
30:54
World Congress 2024 • about 2 years ago

Cross Site Scripting is yesterday's news, isn't it?

martinakraus

Related articles

From learning to earning

Jobs that call for the skills explored in this talk.