Philippe De Ryck

Hi, I'm Philippe, and I help developers protect companies through better web security. As the founder of Pragmatic Web Security, I travel the world to teach practitioners the ins and outs of building secure software.

Want to learn more about OAuth 2.0 and OpenID Connect?

Save yourself days of digging through dozens of specs with this online course

More information

Resources Talks and slide decks

Talks and slide decks

These slide decks from conference talks are packed with security knowledge. They give an overview of current security challenges, along with solutions for building secure applications.

Breaking and securing OAuth 2.0 in frontends

Discover the underestimated threat of Cross-Site Scripting (XSS) in OAuth 2.0 Single Page Applications. Learn about hacks on frontend OAuth clients and explore solutions like the Backend-for-Frontend pattern, ensuring secure implementations of OAuth 2.0.

Supercharging OAuth 2.0 security

Discover how to apply OAuth 2.0 in high-security scenarios, exploring its latest security enhancements. Learn about advanced features like Resource Indicators, JAR, PAR, and DPoP, gaining the knowledge to implement OAuth 2.0 securely.

Passkeys: the future of user authentication

This session explores passkeys as a replacement for complex multi-factor authentication, covering user and developer perspectives and the technical details of passkeys.

The Past, Present, and Future of Cross-Site/Cross-Origin Request Forgery

In this talk, we examine the evolution of CSRF attacks, spotlight the vulnerabilities in API-based applications, and offer best practice defenses to combat these threats effectively.

SEVEN things about API security

In this talk, we delve into key vulnerabilities from the OWASP API Security top 10, demonstrate a practical exploitation example, and discuss two real-world case studies to guide you in enhancing your API security.

AppSec is too hard!?

In this keynote, we review various cases where frameworks and libraries get in the way of security, paving the way for application-level vulnerabilities. With practical examples, we investigate more robust approaches to application security.

Securing an API ecosystem with OAuth 2.0

In this talk, we investigate what OAuth 2.0 brings to the table and how to use those features to secure a modern API ecosystem.

Taking security seriously

In this talk, we take an honest look at the current security landscape. Using plenty of real-world examples, we dive into the dangers applications face today.

How security affects the people behind the code

This keynote reflects on several real-life security incidents and their impact on the people behind the code. From each incident, we will extract lessons learned and translate them into best practices for building secure software.

Token security in Single Page Applications

In this talk, we investigate common misconceptions about token security in Single Page Applications. We discuss the dangers, potential defenses, and recommended best practices.

Forget about OAuth 2.0. Here comes OAuth 2.1

In this session, you will learn about the differences between OAuth 2.0 and OAuth 2.1, and how to follow current best practices to build a secure application architecture.

alert(‘OAuth 2.0’); // The impact of XSS on OAuth 2.0 in SPAs

In this webinar, we take an honest look at the dangers of XSS in SPAs. We discuss the impact on OAuth 2.0 along with current security best practices.

Securing React with Trusted Types

In this talk, we look at Trusted Types, a platform-based defense that will eradicate XSS vulnerabilities in frontends. We investigate how Trusted Types can stop typical React XSS attacks and how to enable Trusted Types for your entire application.

Securing frontend applications with Trusted Types

In this talk, we look at Trusted Types, a platform-based defense that will eradicate XSS vulnerabilities in frontends. We investigate how Trusted Types can stop typical XSS attacks and how to enable Trusted Types for modern frontend applications.

Securing Angular with Trusted Types

In this talk, we look at Trusted Types, a platform-based defense that will eradicate XSS vulnerabilities in frontends. We investigate how Trusted Types can help you boost the security of your Angular application.

OAuth 2.0 and OpenID Connect for Single Page Applications

In this talk, we look at security best practices for using OAuth 2.0 and OpenID Connect in Single Page Applications. We discuss topics such as the Authorization Code flow, token theft, and a backend-for-frontend security pattern.

Serving the right recipe for API authentication

Authentication is a cornerstone of API security. This session explores several authentication recipes for different scenarios, enabling you to choose the right authentication mechanism for your application according to current best practices.

Serving the right recipe for end-user authentication

In 2020, most applications still rely on passwords to authenticate users of an application. In this session, we investigate modern end-user authentication mechanisms, allowing you to make the right decision for your applications.

Getting API security right

Using real-world cases, we discuss common security problems in your APIs along with current best practices for building secure APIs.

Better security through code hygiene

In this session, we discuss how code hygiene techniques boost the security of your applications and make your code scanning tools less anooying and much more effective.

The parts of JWT security nobody talks about

JSON Web Tokens have become the de facto standard to represent claims securely. However, many of the more elaborate security features of JWTs are unknown. This talk covers advanced security best practices for JWT tokens.

Introduction to OAuth 2.0 and OpenID Connect

This talk will provides an introduction to both OAuth 2.0 and OpenID Connect. The talk covers their intended usage scenarios, along with best practices for using them securely.

Recent evolutions in the OAuth 2.0 and OpenID Connect landscape

Ever since the introduction of OAuth 2.0, the framework has been in continuous evolution. In this talk, we will investigate a number of these recent additions. Specifically, we look at “Proof of Key for Code Exchange” (PKCE) flow and Proof-of-Possession (PoP) tokens.

We hate cookies!

Common API security pitfalls

Modern applications consist of a frontend application, backed by an API. In this session, we investigate common security issues in APIs, along with current best practices for building secure APIs.

Authentication with OpenID Connect in Angular applications

In this talk, we look at securely implementing OIDC in an Angular application. We investigate which flow to use in which scenario. We look at the security properties in OpenID Connect, and how to ensure your application respects them.

Angular and the OWASP top 10

The OWASP top 10 is one of the most influential security documents of all time. In this talk, we explore how the OWASP top 10 applies to Angular applications and discuss the most relevant items.

Building secure React applications

Building secure applications with React is easier than starting from scratch. However, even with React, there are several guidelines and considerations to take into account.

The truth about cookies, tokens and APIs

With the rise of Single Page Applications, cookies are being replaced with tokens in custom headers. We dive into the technicalities behind these technologies, and the actual security impact of your choices.

Cookies vs Tokens - a paradoxical choice

Many developers believe cookies are old and tokens are new. However, nothing prevents modern frontend backed by APIs from using cookies. This talk covers the trade-offs and helps you make a substantiated decision for your applications.

Security patterns for keeping secrets in the browser

In this talk, we investigate the strengths and weaknesses of browser-based storage mechanisms. We explore various security strategies to protect sensitive data. We even propose a way to protect data against physical access to the device.

Passwords and pixie dust - A look at OAuth 2.0 security in Angular

In this talk, we give an overview of the flows in OAuth 2.0 that are relevant for Angular applications. We also dive deeper into a recent addition to OAuth 2.0, known as PKCE.

From the OWASP top 10(s) to the OWASP ASVS

This talk will review the OWASP Top Ten 2017 and the OWASP Top Ten Proactive Controls 2018 and compare them to a more comprehensive standard, the OWASP Application Security Verification Standard (ASVS) v3.1.

HTTPS for developers

The HTTPS ecosystem today is vastly different than a couple of years ago. We look at how HTTPS impacts the application. We will see how merely deploying HTTPS is far from sufficient to secure an application.

The reality of building secure APIs

API security is critical yet often neglected, leading to frequent breaches. This expert session uses real-world cases and demos to explore best practices and vulnerabilities, providing actionable guidelines to improve your API security.

Philippe De Ryck

Dr. Philippe De Ryck

Hi, I'm Philippe, and I help developers protect companies through better web security. As the founder of Pragmatic Web Security, I travel the world to teach practitioners the ins and outs of building secure software.

Talks and workshops

You will often find me speaking and teaching at public and private events around the world. My talks always encourage developers to step up and get security right.

Articles

Security is often about small nuances. In my articles, I dive deeper into various security topics, providing concrete guidelines and advice. My articles also answer questions I often get while speaking or teaching.

Security resources

Getting security right is all about knowledge. I strongly believe in sharing that knowledge to move forward as a community. Among my resources, you can find developer cheat sheets, recorded talks, and extensive slide decks.

Mailing list

Subscribe to the Pragmatic Web Security mailing list to stay up to date on the latest activities and resources.

Subscribe