Daniel Szpisjak
360 view of XSS from the trenches
When a software developer first gets exposed to web security, he will inevitably memorize his first acronym: XSS! It stands for “cross site scripting”, and it is one of the oldest vulnerabilities around. Its origins are way back in the 90’s when Javascript was the new kid on the block. XSS (back then it was CSS) was its evil little brother, and it still thrives on its sibling’s success. One may wonder “Why is it called cross site scripting?
Daniel Szpisjak
Cookies
Back in the 90s, someone wanted to store information on the clients, only it was not possible yet. Luckily the Netscape team quickly came to the rescue and implemented cookies. This was a very significant move which shaped the things to come. Cookies became the de-facto state in the statelessness of HTTP. Today they are essential and their security is critical. Here is what you need to know. The fundamentals Before getting into how cookies work let’s take a quick look at the basics.
Daniel Szpisjak
Same-origin policy
When your browser opens a web page, it enforces various security rules. The most important one is the same-origin policy. It defines access rules for dynamic scripts and is considered to be the cornerstone of the web security model. The concept is rather old, it is from 1995 when Netscape Navigator 2 owned the streets of the web. Chances are, you two have already met during your development career, so no need for introductions.
Daniel Szpisjak
Open your browser
Today we live the era of the web and your browser is an integral part of it. As a developer, it is essential to know how stuff works to some degree, and understand how you might affect this behavior to increase security. This post is an intro to that topic! Let’s start with a bit of context, shall we? First, let’s try to define what web browsers are! They are applications used to render data; data that is fetched from a remote location.
Daniel Szpisjak
Thinking like an attacker
The best defense is a good offense! See things from your enemy’s point of view! It takes a thief to catch a thief! All great advice, however, it is a bit hard to utilize them without knowing the context in which they apply. The goal of this post is to provide that context. Who are the attackers? What are their goals? Where are they? That’s what we will cover! Who is the attacker?
Daniel Szpisjak
Defense in Depth a.k.a the Castle Approach
Imagine you are back in middle school and your new science homework is The Egg Drop Project. For those of you not familiar with it, here is a brief description: your task is to design a protective structure for an egg. Once you finished, the egg will be placed in the shuttle you created and dropped from a certain height. The egg must survive the fall without harm! Here is a hint: defense in depth.