Authentication Q&A скачать в хорошем качестве

Authentication Q&A

This is a recording of a discussion and Q&A I held for some of my Patreon supporters on front end authentication practices. Lots of topics covered, check the chapter list for details. 00:00:00 Introduction 00:01:40 How the front end gets a token 00:02:29 Token storage options 00:04:57 Attack vectors 00:08:34 XSS risks with local storage 00:09:49 Using HTTPS 00:11:33 Redirecting HTTP traffic to HTTPS 00:12:10 "secure" flag for cookies 00:16:05 Other risks with XSS 00:17:50 A layered approach to security 00:18:35 local storage vs cookies vs memory 00:21:34 Memory storage and bad user experience 00:23:13 Two different ways for XSS attacks 00:26:10 Using a single JavaScript bundle 00:30:15 Content security policy 00:34:22 Attacks on the Flask secret key 00:37:40 CORS 00:40:43 "samesite" flag for cookies 00:43:57 "httpOnly" flag for cookies 00:45:20 Using a single origin for front and back ends 00:46:25 Short expirations for access tokens 00:47:54 Refreshing access tokens 00:51:04 "path" option for cookies 00:51:49 Refresh token flow 00:53:37 Additional security measures in the refresh flow 00:54:34 Access vs refresh token storage 00:56:19 Using multiple browser tabs 00:58:50 SQL injection attacks 01:00:08 Monitoring approach