An Updated Security Model of the Web

Philippe De Ryck
Philippe De Ryck
Security Expert, Pragmatic Web Security
Abstract

Web security is messy, complicated, and under constant evolution. Often, you even start wondering why certain issues cannot be solved by the browser directly. In this session, we investigate the security model of the web. We learn how browsers think about security, and how we can leverage that to build more secure applications. We explicitly focus on new browser features and how they can be used. Examples include the sanitization API, new cookie prefixes, as well as features focusing on script integrity. This session will give you an up-to-date understanding of browser security in the modern age.

00:00:00 Introduction and updated web security model

00:03:32 Origins and the Same-Origin Policy

00:09:17 Origin isolation as a security boundary

00:11:45 Sites, eTLD+1, and the public suffix list

00:16:48 Schemeful same-site and site isolation

00:19:51 Cookies as browser-managed authentication state

00:23:16 Secure and HttpOnly cookie flags

00:25:55 Cookie tossing and session fixation

00:31:31 Cookie prefixes and best practices

00:38:58 Preventing client-side XSS

00:45:44 Safe DOM APIs and sanitization

00:50:20 Built-in Sanitizer and setHTML APIs

00:56:04 Remote script risks and Subresource Integrity

00:59:55 Enforcing SRI with Integrity Policy

01:04:42 CSP hash reporting and key takeaways