Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Web Platform Security @ CMS Security Summit

Avatar for Mike West Mike West
January 30, 2019
Programming
0
130

Web Platform Security @ CMS Security Summit

A quick overview of the kinds of things Chrome's thinking about from a web platform perspective.
Avatar for Mike West

Mike West

January 30, 2019
Tweet

More Decks by Mike West

See All by Mike West
W3C Permissions Workshop - 2022-12-05
Avatar for Mike West mikewest
0
120
Isolation by Default
Avatar for Mike West mikewest
0
1.9k
The Web We Can Ship
Avatar for Mike West mikewest
0
500
Web Platform Security @ CMS Security Summit 2020
Avatar for Mike West mikewest
0
3.3k
Web Platform Security @ TechDays 2019
Avatar for Mike West mikewest
1
180
Cookies are bad @ HTTP Workshop 2019
Avatar for Mike West mikewest
0
460
Web Platform Security PhD Summit @ Google Munich
Avatar for Mike West mikewest
2
990
BSides Munich
Avatar for Mike West mikewest
0
340
Hardening the Web Platform - AppSec EU, 2016
Avatar for Mike West mikewest
5
1.5k

Other Decks in Programming

See All in Programming
LT 2025-06-30: プロダクトエンジニアの役割
Avatar for Keisuke Yamamoto yamamotok
0
670
プロダクト志向ってなんなんだろうね
Avatar for RightTouch righttouch
PRO
0
180
ふつうの技術スタックでアート作品を作ってみる
Avatar for Akira Yagi akira888
0
320
XP, Testing and ninja testing
Avatar for seki at druby.org m_seki
3
220
Webの外へ飛び出せ NativePHPが切り拓くPHPの未来
Avatar for Takuya Katsusa takuyakatsusa
2
460
PHP 8.4の新機能「プロパティフック」から学ぶオブジェクト指向設計とリスコフの置換原則
Avatar for 武田 憲太郎 kentaroutakeda
2
710
AIプログラマーDevinは PHPerの夢を見るか？
Avatar for Shinya Saita shinyasaita
1
190
GraphRAGの仕組みまるわかり
Avatar for とすり tosuri13
8
520
Is Xcode slowly dying out in 2025?
Avatar for 上ちょ / uetyo uetyo
1
250
既存デザインを変更せずにタップ領域を広げる方法
Avatar for Tiphaine tahia910
1
270
LINEヤフー データグループ紹介
Avatar for LINEヤフー株式会社 採用情報 lycorp_recruit_jp
0
1.7k
WindowInsetsだってテストしたい
Avatar for RyuNen344 ryunen344
1
230

Featured

See All Featured
Reflections from 52 weeks, 52 projects
Avatar for Jefferson Lam jeffersonlam
351
20k
Mobile First: as difficult as doing things right
Avatar for Swwweet swwweet
223
9.7k
For a Future-Friendly Web
Avatar for Brad Frost brad_frost
179
9.8k
Making the Leap to Tech Lead
Avatar for Ryan Cromwell cromwellryan
134
9.4k
Designing for humans not robots
Avatar for Tammie Lister tammielis
253
25k
What's in a price? How to price your products and services
Avatar for Michael Herold michaelherold
246
12k
We Have a Design System, Now What?
Avatar for Morgane Peng morganepeng
53
7.7k
Why Our Code Smells
Avatar for Brandon Keepers bkeepers
PRO
337
57k
The Cost Of JavaScript in 2023
Avatar for Addy Osmani addyosmani
51
8.5k
Why You Should Never Use an ORM
Avatar for John Nunemaker jnunemaker
PRO
58
9.4k
Git: the NoSQL Database
Avatar for Brandon Keepers bkeepers
PRO
430
65k
[RailsConf 2023 Opening Keynote] The Magic of Rails
Avatar for Eileen M. Uchitelle eileencodes
29
9.5k

Transcript

  1. Proprietary + Confidential Proprietary + Confidential Web Platform Security @

    CMS Security Summit - 2019-01-30 Proprietary + Confidential Mike West, [email protected], @mikewest

  2. Proprietary + Confidential Proprietary + Confidential HTTPS

  3. Proprietary + Confidential https://transparencyreport.google.com/https/overview

  4. Proprietary + Confidential Proprietary + Confidential Address Bar UX: Today

  5. Proprietary + Confidential Proprietary + Confidential Address Bar UX: Eventually

  6. Proprietary + Confidential Proprietary + Confidential What's next? We aim

    to expire non-secure cookies early rather than sending them over non-secure connections. https://github.com/mikewest/cookies-over-http-bad

  7. Proprietary + Confidential Proprietary + Confidential What's next? We're exploring

    locking some high-entropy headers to secure connections (for example, `User-Agent` and `Accept-Lang`). https://tools.ietf.org/html/draft-west-ua-client-hints https://tools.ietf.org/html/draft-west-lang-client-hint

  8. Proprietary + Confidential Proprietary + Confidential XSS / XSSI /

    CSRF

  9. Proprietary + Confidential Proprietary + Confidential CSP is great. You

    should use it! https://csp.withgoogle.com Trusted Types looks promising. Please give us feedback! https://github.com/WICG/trusted-types/

  10. Proprietary + Confidential Proprietary + Confidential SameSite Cookies https://tools.ietf.org/html/draft-ietf-httpbis-rfc6265bis-02

  11. Proprietary + Confidential Proprietary + Confidential Fetch Metadata https://mikewest.github.io/sec-metadata/

  12. Proprietary + Confidential Proprietary + Confidential Spectre

  13. Proprietary + Confidential Proprietary + Confidential

  14. Proprietary + Confidential Proprietary + Confidential Site Isolation

  15. Proprietary + Confidential Proprietary + Confidential Cross Origin Resource Policy

    https://fetch.spec.whatwg.org/#cross-origin-resource-policy-header

  16. Proprietary + Confidential Proprietary + Confidential Cross Origin Opener Policy

    https://github.com/whatwg/html/issues/3740

  17. Proprietary + Confidential Proprietary + Confidential CORS-Only Mode https://github.com/whatwg/html/issues/4175

  18. Proprietary + Confidential Proprietary + Confidential Why "site"? Why not

    "origin"? https://www.chromestatus.com/metrics/feature/timeline/popularity/739

  19. Proprietary + Confidential Proprietary + Confidential Feature Policy https://w3c.github.io/webappsec-feature-policy/

  20. Proprietary + Confidential Proprietary + Confidential Origin Policy https://wicg.github.io/origin-policy/

  21. Proprietary + Confidential Proprietary + Confidential Thanks! Mike West [email protected]

    @mikewest