XSS Mitigation - The State of the Art

This talk explains how to defend web applications against cross-site scripting through browser protections, server-side mitigations, framework practices, threat modeling, and supply-chain security. It includes live demonstrations of XSS exploitation and defenses.

Syllabus

Intro
Main XSS variants
Web security model: Same Origin Policy, 1995
Juicy targets: Electron apps
Most common bypasses
Disable JavaScript
Trusted Types
Cookies security
The future of browser defenses
Server Side Rendering options
Auto Content Security Policy for Server Side Rendering
Templating engines-level mitigations
Static Application Security Testing (SAST)
Existing standards mitigations overview (aka security headers soupe)
The future of server side mitigations
Battlecards: XSS threat model
Frameworks and associated risks
Supply chain security: XSS specific risks Remote dependencies can be tampered with
XSS defense in depth