CSP is one of the most elaborate security policies in modern browsers. Besides acting as a second line of defense against XSS, CSP offers control over various types of content, outgoing connections, and the application's behavior. In this article, we elaborate on these features and provide you with a prioritized CSP deployment guide that will help you configure CSP in production.

24 May 2022 Security Policies Browser Security, Content Security Policy (CSP), XSS

The recommended best practice for modern CSP policies relies on hashes, nonces, and 'strict-dynamic'. Unfortunately, these features conflict with modern SPAs. This article proposes three concrete strategies to deploy secure CSP policies for SPAs. The first relies on a simple policy allowing 'self', which is acceptable under certain circumstances. The second strategy enables CSP hashes by rewriting the main page to use a script loader. The third strategy inserts nonces into a dynamically served main page.

11 April 2022 Security Policies Browser Security, Content Security Policy (CSP), XSS

Like them or hate them, JSON Web Tokens (JWT) are everywhere. Unfortunately, JWTs also lie at the heart of numerous API security failures. In this article, we cover seven techniques that will help you avoid JWT security pitfalls.

22 December 2021 API Security API, JWT

Content Security Policy (CSP) started as a simple defense but quickly evolved into a complex security policy. This article investigates how to build an effective CSP policy to counter XSS vulnerabilities. Concretely, we use step-by-step examples to highlight bypasses against CSP and examine how to use nonces, hashes, and 'strict-dynamic' to build a robust CSP policy for modern applications.

13 December 2021 Security Policies Browser Security, Content Security Policy (CSP), XSS

XSS vulnerabilities remain a top threat to any HTML-based web application. In fact, 75% of web vulnerabilities in Google's reward program are XSS vulnerabilities! Fortunately, built-in platform defenses such as Content Security Policy and Trusted Types equip us with the tools to tackle XSS. In this article, we briefly look at modern XSS vulnerabilities, followed by a detailed look at using Trusted Types policies to mitigate such vulnerabilities. In the end, we provide you with a list of concrete developer guidelines to apply Trusted Types in your projects.

15 June 2021 Security Policies Browser Security, Content Security Policy (CSP), XSS, Trusted Types

In this article, we investigate the security properties of refresh tokens in the browser. We investigate why frontend web applications need refresh token rotation and what we gain by using refresh token rotation. Next, we dive into concrete attack scenarios that bypass refresh token rotation and discuss how sensitive SPAs should use a backend-for-frontend to secure tokens.

9 April 2021 OAuth 2.0 & OpenID Connect OAuth 2.0, XSS, Single Page Applications, Refresh tokens

A Cross-Site Scripting (XSS) vulnerability can and will lead to the full compromise of a frontend application. An XSS vulnerability allows the attacker to control the application in the user's browser, extract sensitive information, and make requests on behalf of the application. Modern frameworks come with built-in defenses against XSS, but how far do they really go? In this article, we look at Angular's built-in XSS defenses, along with insecure coding patterns that inadvertently bypass these protections.

1 February 2021 SPA Security XSS, Angular, Single Page Applications

JSON.stringify() is perhaps one of the most mundane APIs in modern browsers. The functionality to translate a JavaScript object into a string-based representation is hardly thrilling. But when the stars align, a simple JSON serialization operation can result in a significant XSS vulnerability. This article tells the nail-biting story of such a vulnerability in Scully, an Angular-based static site generator.

26 January 2021 SPA Security XSS, Angular, Scully, Single Page Applications

Traditionally, OAuth 2.0 applications rely on iframes to silently obtain tokens in the background while the application remains running in the foreground. With the ongoing efforts to block third-party cookies, these flows become increasingly unreliable. Use the new version of the Flow Simulator to visualize the effects of third-party cookie blocking in Brave and Safari.

24 November 2020 OAuth 2.0 & OpenID Connect OAuth 2.0, OIDC, Online Courses, Flow Simulator

Frame-based attacks such as clickjacking and UI redressing may be obscure, but they are (still) very real. They even threaten APIs, which have nothing to do with iframes and web pages. This article gives an overview of the threats, discusses recent changes in framing restriction mechanisms, and provides concrete recommendations to secure modern web applications.

15 September 2020 Security Policies Browser Security, X-Frame-Options (XFO), Content Security Policy (CSP)

Have you ever heard of the device flow, or the OAuth 2.0 Device Authorization Grant? If not, make sure you keep reading, as the device flow is pretty awesome to support an ever-growing group of applications. If you already know about the device flow, you should skip to the second half of the article, where we discuss the details and the surprising amount of security benefits.

18 August 2020 OAuth 2.0 & OpenID Connect OAuth 2.0, OIDC, Authentication

I often need to explain the different steps in OAuth 2.0 and OpenID Connect flows, for example during a training or consulting session. Illustrating the numerous steps with a real-world application is always challenging, especially since many of the requests are invisible to the user. That's why I built the Flow Simulator, which allows you to walk through a flow step by step, while visualizing all the relevant details. Keep reading to learn all about the publicly available Flow Simulator.

7 July 2020 OAuth 2.0 & OpenID Connect OAuth 2.0, OIDC, Online Courses, Flow Simulator

Everyone who first learns about OAuth 2.0 and OpenID Connect is confused. There are dozens of specifications with uncommon terminology and hard-to-understand scenarios. That's why I am excited to announce this free introductory course, which is the perfect starting point for your journey into OAuth 2.0 and OpenID Connect. More details are available in this article.

1 July 2020 OAuth 2.0 & OpenID Connect OAuth 2.0, OIDC, Online Courses

Preventing XSS in React is manageable when you stay within the boundaries of the framework, but becomes hard once you step out of React's safe zone. In this article, we take a closer look at escape hatches and component parsers and all the reasons you should avoid them. Read on to discover the next level of XSS in React applications.

14 June 2020 SPA Security XSS, React, Single Page Applications

Dynamically rendering benign HTML code in React requires the use of dangerouslySetInnerHTML. That is not a naming mistake. This property is dangerous, and using it carelessly will create XSS vulnerabilities in your application. In this article, we discuss why the property is there, how you can use it, and how the Signal messenger misused it. This article is the second in a series of three, and a must-read for every React developer.

28 May 2020 SPA Security XSS, React, Single Page Applications

Good audio for virtual presentations is absolutely critical. Even before the new world of 2020, I was delivering remote training and recording videos, so I invested in a decent audio setup. Since the Corona pandemic coincided with the birth of our third child, training from home sure became a totally new challenge. To make that as comfortable as possible, I built myself a standing desk and added a dedicated camera to the setup. A few people asked about my setup, I decided to provide a bit more details in this article.

21 May 2020 Productivity Recording, Training

A Cross-Site Scripting (XSS) vulnerability can and will lead to the full compromise of a frontend application. An XSS vulnerability allows the attacker to control the application in the user's browser, extract sensitive information, and make requests on behalf of the application. Modern frameworks come with built-in defenses against XSS, but how far do they really go? In this article series, we look at how React prevents XSS, but also how its shortcomings leave a lot in the hands of a developer. This article is the first in a series of three.

13 May 2020 SPA Security XSS, React, Single Page Applications

About a year ago, the OAuth 2.0 Implicit flow became deprecated. That decision caused a lot of confusion and frustration. In this article, we analyze the different OAuth 2.0 flows to find out why the OAuth working group made that decision. Read on to find out about current best practices for using OAuth 2.0 in modern web applications.

7 May 2020 OAuth 2.0 & OpenID Connect OAuth 2.0, PKCE, Single Page Applications

Single Page Applications can use refresh tokens in the browser. Yes, you read that right. This new development is awesome, because it makes access token renewal much more elegant. However, refresh tokens in the browser require additional security measures, such as refresh token rotation. We discuss the pros and cons of refresh token rotation, along with the potential dangers. In the end, you will find five strategies you can use to secure your tokens in your web frontends better.

30 April 2020 OAuth 2.0 & OpenID Connect OAuth 2.0, Refresh tokens, XSS

Most developers are afraid of storing tokens in LocalStorage due to XSS attacks. While LocalStorage is easy to access, the problem actually runs a lot deeper. In this article, we investigate how an attacker can bypass even the most advanced mechanisms to obtain access tokens through an XSS attack. Concrete recommendations are provided at the end.

16 April 2020 OAuth 2.0 & OpenID Connect OAuth 2.0, LocalStorage, XSS

URL parameters are straightforward to send information along in a request. Decades ago, we already used them to transport session identifiers, and today, many applications still use them for all kinds of purposes. But are URL parameters secure? What alternatives are there? Keep reading to find out more.

14 April 2020 API Security API, JWT, Crypto

In spite of the popularity of JWTs, their security properties are often unknown or misunderstood. How do you choose the signature scheme for a JWT? What other properties should you verify before trusting a JWT? How do you handle key rotation and key management? Read on for a deep-dive into JWT security.

13 March 2020 API Security API, JWT, Crypto