Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
a11y club: The Cake Is a Lie... And So Is Your ...
Search
Ramona Schwering
June 17, 2026
Technology
17
0
Share
Embed
Copy iframe code
Copy JS code
Copy link
Start on current slide
a11y club: The Cake Is a Lie... And So Is Your Login’s a11y.
Ramona Schwering
June 17, 2026
More Decks by Ramona Schwering
See All by Ramona Schwering
Dangerous Reactivity: Why AI Output Is the New XSS Vue
leichteckig
0
20
React with Caution: How to Hack Your React App (And Fix It Too)
leichteckig
0
14
Vue'tiful Defense
leichteckig
0
83
Workshop: The Cake is a Lie!
leichteckig
0
41
The Cake Is a Lie... And So Is Your Login’s Accessibility
leichteckig
0
230
Plants vs thieves: Automated Tests in the World of Web Security
leichteckig
0
230
From the Crypt to the Code
leichteckig
0
250
You shall not pass!? A short story of customizable login experiences
leichteckig
0
95
Access Granted!
leichteckig
0
150
Other Decks in Technology
See All in Technology
MulticaとPi Coding Agentで、小規模OSSを30本同時運用した流れ
eiei114
0
140
Head First モブプログラミング / Head First Mobprogramming
takaking22
10
12k
小粒でもパワフルなJS Runtime Antjsについて
comamoca
0
120
AIにブラウザを触らせて、E2EテストをPlaywrightで書く
koji_kawamura
0
310
Flutter × BLE Centralを自前Pluginで実装する設計パターン - MethodChannel / EventChannelで作る双方向ブリッジの実践 / Building Custom Flutter BLE Central Plugins: Bidirectional Bridging with Method & Event Channels
bitkey
PRO
0
210
AIで変わるエンジニアの働き方(仮)
naoinaoi
0
310
35分でわかるEffective Platform Engineering
nwiizo
5
580
【GCC2026】大規模言語モデルを活用した内製検索サービスの社内展開や業務活用
bandainamcostudios
PRO
0
440
DatadogのBits Chatが開発組織にもたらしたもの / What Bits Chat Has Brought Us
sms_tech
1
290
DDDのエッセンスを取り入れたAIでの開発
ak2ie
0
200
形式手法特論:Hyperproperty とモデル検査 #kernelvm / Kernel VM Study Tokyo 19th
ytaka23
0
580
AI-DLC実践録_フルサイクル開発への挑戦
miyuc
0
340
Featured
See All Featured
実際に使うSQLの書き方 徹底解説 / pgcon21j-tutorial
soudai
PRO
201
75k
Responsive Adventures: Dirty Tricks From The Dark Corners of Front-End
smashingmag
254
22k
A Guide to Academic Writing Using Generative AI - A Workshop
ks91
PRO
1
380
The Web Performance Landscape in 2024 [PerfNow 2024]
tammyeverts
12
1.3k
The State of eCommerce SEO: How to Win in Today's Products SERPs - #SEOweek
aleyda
2
11k
The Invisible Side of Design
smashingmag
301
52k
The SEO Collaboration Effect
kristinabergwall1
1
530
SEO in 2025: How to Prepare for the Future of Search
ipullrank
3
3.8k
Faster Mobile Websites
deanohume
310
32k
WENDY [Excerpt]
tessaabrams
11
39k
A Modern Web Designer's Workflow
chriscoyier
698
190k
Un-Boring Meetings
codingconduct
0
390
Transcript
Automated Tests in the World of Web Security
None
None
What does that have to do with web development?
None
None
None
None
None
Garden
Garden House = Protected parts
Garden Garden = our defenses House = Protected parts
None
Security best practises
None
Broken Access Control
Broken Access Control Cryptographic Failures
Broken Access Control Cryptographic Failures Injection
Test Cases
Injection
Testing XSS it('checks for XSS vulnerability', () => { cy.visit('http://example.com/contact-form');
cy.get('input[name="name"]').type('<script>alert("XSS")</script>'); cy.get('form').submit(); cy.contains('<script>alert("XSS")</script>').should('not.exist'); });
Testing XSS it('checks for XSS vulnerability', () => { cy.visit('http://example.com/contact-form');
cy.get('input[name="name"]').type('<script>alert("XSS")</script>'); cy.get('form').submit(); cy.contains('<script>alert("XSS")</script>').should('not.exist'); });
Testing XSS it('checks for XSS vulnerability', () => { cy.visit('http://example.com/contact-form');
cy.get('input[name="name"]').type('<script>alert("XSS")</script>'); cy.get('form').submit(); cy.contains('<script>alert("XSS")</script>').should('not.exist'); });
Testing XSS it('checks for XSS vulnerability', () => { cy.visit('http://example.com/contact-form');
cy.get('input[name="name"]').type('<script>alert("XSS")</script>'); cy.get('form').submit(); cy.contains('<script>alert("XSS")</script>').should('not.exist'); });
Testing XSS it('checks for XSS vulnerability', () => { cy.visit('http://example.com/contact-form');
cy.get('input[name="name"]').type('<script>alert("XSS")</script>'); cy.get('form').submit(); cy.contains('<script>alert("XSS")</script>').should('not.exist'); });
it('checks for CSRF vulnerability', () => { cy.request({ method: 'POST',
url: 'http://example.com/update-profile', form: true, body: { name: 'John Doe', email: '
[email protected]
' } }).then((response) => { expect(response.status).to.eq(403); }); }); Testing CSRF
Testing CSRF it('checks for CSRF vulnerability', () => { cy.request({
method: 'POST', url: 'http://example.com/update-profile', form: true, body: { name: 'John Doe', email: '
[email protected]
' } }).then((response) => { expect(response.status).to.eq(403); }); });
Testing CSRF it('checks for CSRF vulnerability', () => { cy.request({
method: 'POST', url: 'http://example.com/update-profile', form: true, body: { name: 'John Doe', email: '
[email protected]
' } }).then((response) => { expect(response.status).to.eq(403); }); });
Testing CSRF it('checks for CSRF vulnerability', () => { cy.request({
method: 'POST', url: 'http://example.com/update-profile', form: true, body: { name: 'John Doe', email: '
[email protected]
' } }).then((response) => { expect(response.status).to.eq(403); }); });
Testing CSRF it('checks for CSRF vulnerability', () => { cy.request({
method: 'POST', url: 'http://example.com/update-profile', form: true, body: { name: 'John Doe', email: '
[email protected]
' } }).then((response) => { expect(response.status).to.eq(403); }); });
Testing SQL Injection it('checks for SQL injection vulnerability', () =>
{ cy.visit('http://example.com/search?query=1 OR 1=1'); cy.contains('Error:').should('not.exist'); });
Testing SQL Injection it('checks for SQL injection vulnerability', () =>
{ cy.visit('http://example.com/search?query=1 OR 1=1'); cy.contains('Error:').should('not.exist'); });
Testing SQL Injection it('checks for SQL injection vulnerability', () =>
{ cy.visit('http://example.com/search?query=1 OR 1=1'); cy.contains('Error:').should('not.exist'); });
CSP Testing Using Cypress const { defineConfig } = require('cypress')
module.exports = defineConfig({ // https://on.cypress.io/experiments // https://github.com/cypress-io/cypress/issues/1030 experimentalCspAllowList: ['default-src', 'script-src'], e2e: { baseUrl: 'http://localhost:3003', }, });
CSP Testing Using Cypress const { defineConfig } = require('cypress')
module.exports = defineConfig({ // https://on.cypress.io/experiments // https://github.com/cypress-io/cypress/issues/1030 experimentalCspAllowList: ['default-src', 'script-src'], e2e: { baseUrl: 'http://localhost:3003', }, });
CSP Testing Using Cypress it('serves Content-Security-Policy header', () => {
cy.request('/') .its('headers') .should('have.property', 'content-security-policy') // confirm parts of the CSP directive .should('include', "default-src 'self'") .and('include', 'report-uri /security-attacks’); });
CSP Testing Using Cypress it('serves Content-Security-Policy header', () => {
cy.request('/') .its('headers') .should('have.property', 'content-security-policy') // confirm parts of the CSP directive .should('include', "default-src 'self'") .and('include', 'report-uri /security-attacks’); });
CSP Testing Using Cypress it('serves Content-Security-Policy header', () => {
cy.request('/') .its('headers') .should('have.property', 'content-security-policy') // confirm parts of the CSP directive .should('include', "default-src 'self'") .and('include', 'report-uri /security-attacks’); });
CSP Testing Using Cypress it('stops XSS and reports CSP violations',
() => { cy.intercept('/security-attacks', {}).as(‘cspAttacks'); cy.on('window:load', (win) => cy.stub(win.console, ‘log').as('log')); cy.visit(‘/'); cy.get('#message').type('Hello<img src="" onerror="console.log(`hacked`)" />’); cy.contains('button', ‘Send').click(); cy.contains('#messages li', ‘Hello'); cy.log('**XSS stopped and reported**') cy.wait('@cspAttacks').its('request.body').should('include', ‘blocked'); cy.get(‘@log').should('not.be.called'); })
CSP Testing Using Cypress it('stops XSS and reports CSP violations',
() => { cy.intercept('/security-attacks', {}).as(‘cspAttacks'); cy.on('window:load', (win) => cy.stub(win.console, ‘log').as('log')); cy.visit(‘/'); cy.get('#message').type('Hello<img src="" onerror="console.log(`hacked`)" />’); cy.contains('button', ‘Send').click(); cy.contains('#messages li', ‘Hello'); cy.log('**XSS stopped and reported**') cy.wait('@cspAttacks').its('request.body').should('include', ‘blocked'); cy.get(‘@log').should('not.be.called'); })
CSP Testing Using Cypress it('stops XSS and reports CSP violations',
() => { cy.intercept('/security-attacks', {}).as(‘cspAttacks'); cy.on('window:load', (win) => cy.stub(win.console, ‘log').as('log')); cy.visit(‘/'); cy.get('#message').type('Hello<img src="" onerror="console.log(`hacked`)" />’); cy.contains('button', ‘Send').click(); cy.contains('#messages li', ‘Hello'); cy.log('**XSS stopped and reported**') cy.wait('@cspAttacks').its('request.body').should('include', ‘blocked'); cy.get(‘@log').should('not.be.called'); })
Cover Login / Auth APIs
... cy.get('#username').type(username); cy.get('#password').type(password); cy.get('[type="submit"]').click(); cy.contains('Access denied') .should('not.exist'); ... Cover Authn
/ Login
HTTPS!?
None
Test Automation Tools
None
SAST Tools
SAST Tools DAST Tools
SAST Tools DAST Tools IAST Tools
SAST Tools DAST Tools IAST Tools Static Code Quality Analysis
SAST Tools Keeping dependencies up-to-date DAST Tools IAST Tools Static
Code Quality Analysis
General testing practises
None
None
Understand your app
Understand your app Create a test plan
Understand your app Create a test plan Write your test
cases
Understand your app Create a test plan Write your test
cases Execute tests and analyse
Understand your app Create a test plan Write your test
cases Execute tests and analyse Include other tools
Understand your app Create a test plan Write your test
cases Execute tests and analyse Include other tools Repeat your test runs
Understand your app Create a test plan Write your test
cases Execute tests and analyse Include other tools Repeat your test runs
None
None
None
None
Automation = great complement
Automation = great complement Simple steps are most useful
Automation = great complement Simple steps are most useful Combine
own test cases + Tools
Automation = great complement Simple steps are most useful Combine
own test cases + Tools All testing types can be utilized
None