Vue'tiful Defense

For many developers, learning about security in Vue can sound intimidating or boring. This session is designed to flip that impression on its head completely - I will draw my sketch notes on secure Vue development live on stage, together with you ❤️ We won't just talk about threats; we will bring them to life as sketch notes on the big screen of VueJS Amsterdam! Then, as a team, we'll discover and design the "magical" armor our app needs. Along with learning about our allies, such as the OWASP project. My goal is for everyone to leave the room feeling confident and ready to be a security champion on their team, armed with a sketch note handout. This way, my session combines two of my greatest passions: building high-quality software and making complex topics accessible and engaging through art.

Transcript

1. OWASP Mind · D /Broken) Access your build vet you e! ' A " ranky Control ⊥ ' ః mind your rank 3 ' · dependencies M ٕ ੌ i18 prototype RQDOS Qf Mne-tiful য ∞ G vue- pollution QUE common vurnerable Ƙ Defense ! a router Exposures য L client-side XSS = tricking browser only ௏ب to execute ^ code extra prototype pollution content compiler content automaticali policy ef in rue template ৡ { escaped f mileh neader, 、 hu template- & render t Attribute 1 malicious ഐܳ tt embedded , miniase functions Bindings Injection : Extra Mile! ∵ HIML JS URL ŷ clickjacking SQL mi button e