This document describes a boy who brought his sugar glider on a plane trip and had issues with the TSA inspecting it. It then discusses common web security attacks like cross-site request forgery and cross-site scripting, and methods to prevent these attacks like input validation, sanitization, and escaping. It emphasizes applying security measures on both the client-side and server-side to protect against malicious inputs and unauthorized requests.

1. A Boy,
A Sugar Glider and
the TSA
Brian Clark
@_clarkio
Credit: https://www.flickr.com/photos/pitmanra/

2. Credit: https://www.flickr.com/photos/pitmanra/
The
Story

3. Credit: https://www.flickr.com/photos/diamondtdesign/

4. Credit: https://www.flickr.com/photos/25802865@N08/

5. Credit: https://www.flickr.com/photos/lostintexas/

6. Credit: https://www.flickr.com/photos/muar_chee/

7. Browser
http://insecureheroes.com
Server
http://insecureheroes.com

8. Browser
http://insecureheroes.com
Server
http://insecureheroes.com

9. Browser
http://insecureheroes.com
Server
http://insecureheroes.com

10. Browser
http://insecureheroes.comCookies
Server
http://insecureheroes.com

11. Browser
http://insecureheroes.comCookies
Server
http://insecureheroes.com
Hero: Luke

12. Browser
http://insecureheroes.comCookies
Server
http://insecureheroes.com
http://clickbaity.co

13. Browser
http://insecureheroes.comCookies
Server
http://insecureheroes.com
http://attacker.com
Attack
insecureheroes.com
Hero: Darth

14. An attack that executes a request on behalf of another
authenticated user that was not intending to perform
that action being requested
Cross-site Request Forgery

15. Synchronizer
Token
Pattern
Random token
Unique to user and
session
Part of the request header
Validated server-side

16. https://www.npmjs.com/package/csur
f

18. https://angular.io/guide/http#security-xsrf-protection

19. https://caniuse.com/#search=samesi
te

20. Credit: https://www.flickr.com/photos/hyku/

21. Credit: https://www.flickr.com/photos/hdport/

22. Credit: https://www.flickr.com/photos/27229185@N05/

23. An attack that injects malicious code into a trusted web
site such that it may be executed unintendedly by other
users
Cross-site Scripting (XSS)

24. Prevention
Content Security PolicyInput Handling
Control what resources
the browser is allowed to
load
Ensure data is aligned
with the expectations for
its intended use

25. Input Handling

26. Input Handling
EscapingSanitizationValidation

27. Sanitization EscapingValidation
Ensure the data is legit
Invalid Email
Result
:

28. Validation EscapingSanitization
Clean the bad data
BC
Result
:

29. SanitizationValidation Escaping
Encode the bad data
B<script>alert(1);</script>C
Result
:

30. Do not trust user input

31. Where should we apply
input handlers?

32. Where should we apply
input handlers?
Client? Server?

33. Browser
http://insecureheroes.com
Server
http://insecureheroes.com
Security
Boundary

34. Browser
http://insecureheroes.com
Server
http://insecureheroes.com
Security
Boundary
Untrusted

35. Browser
http://insecureheroes.com
Server
http://insecureheroes.com
Security
Boundary
Trusted

36. Both

39. https://angular.io/guide/security

40. https://angular.io/guide/security

42. https://www.npmjs.com/package/express-validator

43. https://www.npmjs.com/package/xss-filters

44. Summary
Access Control
Malicious Input
Sugar Gliders
Faking Requests

45. Reference
s
https://owasp.org
https://github.com/Azure-Samples/angular-cosmosdb
(branch: insecure-heroes)
https://angular.io/guide/security
https://www.npmjs.com/package/csurf
https://angular.io/guide/http#security-xsrf-protection
https://caniuse.com/#search=samesite

46. Brian Clark
@_clarki
o
Thank You!