PodParley PodParley
PodParley
731: Client side security, XSS attacks & CSP with Stripe’s Alex Sexton

EPISODE · Feb 16, 2024 · 1H 3M

731: Client side security, XSS attacks & CSP with Stripe’s Alex Sexton

from Syntax - Tasty Web Development Treats · host Wes Bos & Scott Tolinski - Full Stack JavaScript Web Developers

Scott and Wes are joined by security expert, Alex Sexton of Stripe to cover all things: client security, XSS, attack vectors, and CSP (content security policy). Show Notes 00:00 Welcome to Syntax! 00:31 Brought to you by Sentry.io. 00:57 Who is Alex Sexton? 04:44 Stripe dashboard is a work of art. 05:08 Tell us about the design system. React Aria 08:59 Who develops the iOS app? 09:50 Stripe’s CSP (content security policy). 12:50 What even is a content security policy? Content Security Policy explanation 13:57 Douglas Crockford of Yahoo on security. Douglas on GitHub 15:13 Security philosophy. 16:59 What about inline styles and inline JavaScript? 19:41 How do we safely set inline styles from JS? 20:20 Setting up with meta tags. 22:52 What are common situations that require security exceptions? 26:24 Potential damage with inline style tags. 32:45 Looping vulnerabilities. 36:32 What about JavaScript injection? 37:09 Myspace Samy Worm. Myspace Samy Worm Wiki Sentry.io Security Policy Reporting 42:02 Does a CSP stop code from running in the console? 43:28 What are some general security best practices? 46:35 Strategies for rolling out a CSP. 51:49 Final tip, Strict Dynamic. Strict Dynamic 56:36 Where does the CSP live within Stripe? Original Black Friday story 59:35 One last story. 01:01:20 Sick Picks + Shameless Plugs Sick Picks + Shameless Plugs Alex: Wes Bos’ Instagram Hit us up on Socials! Syntax: X Instagram Tiktok LinkedIn Threads Wes: X Instagram Tiktok LinkedIn Threads Scott:X Instagram Tiktok LinkedIn Threads Randy: X Instagram YouTube Threads

NOW PLAYING

731: Client side security, XSS attacks & CSP with Stripe’s Alex Sexton

0:00 1:03:11

No transcript for this episode yet

We transcribe on demand. Request one and we'll notify you when it's ready — usually under 10 minutes.

Share this episode

Similar Episodes

No similar episodes found.

Similar Podcasts

Managing Next Generation Energy Systems Cambridge University Background Stakeholders working with energy systems have to make complex decisions formulated from risk-based assessments about the future. The move towards more renewables in our energy systems complicates matters even further, requiring the development of an integrated power grid and continuous and steady transformation of the UK power system. Network flows must be managed reliably under uncertain demands, uncertain supply, emerging network technologies and possible failures and, further, prices in related markets can be highly volatile. Mathematicians working with engineers and economists, can make significant contributions to address such issues, by helping to develop fit-for-purpose models for next generation energy systems. These interdisciplinary approaches are looking to address a range of associated problems, including modelling, prediction, simulation, control, market and mechanism design and optimisation. This knowledge exchange workshop was part of the four months Res Integrating Nutrition, Psychology and Neuroscience to Measure Infant Development in the UK & Gambia Talk by Dr Sarah Lloyd Fox, Birkbeck College, on infant brain imaging in The Gambia Rise Up Mentor Derek Kempker Welcome to Rise Up Mentor (formerly, Summits of Life), a platform that advocates for lifelong learning and constant improvement in every aspect of life. As someone who’s experienced both the valleys and peaks of life, I understand that while we cannot control all the obstacles that come our way, we do have the power to choose whether we get back up or not. And each time we choose to rise again, we become stronger.But why settle for just getting back up? By consistently striving to become better and wiser, we can reduce our chances of being knocked down in the first place. That’s why I started Rise Up Mentor – to encourage and motivate you to continuously improve in all areas of life, including vocation, marriage, friendship, personal development, health, parenting, lifestyle, spirituality, intellect, and finance.Although I am a Certified Master Life Coach, I don’t consider myself an expert or master, because I don’t feel there is such a thing as mastering life, but it is possible to Kaizen Blueprint Aldo Chandra "Kaizen" is a Japanese term for continuous improvement. This podcast provides a blueprint to learn about health, wealth, relationships and everything else in between. Through our podcast, we strive to inspire, educate, and motivate our audience to cultivate a mindset of lifelong learning, productivity, and personal development. By sharing insights, strategies, and practical tips, we aim to guide listeners on their journey towards realizing their fullest potential, fostering success, and creating lasting positive change.
URL copied to clipboard!