SecAppDev original
An Updated Security Model of the Web
Video and handoutsSecAppDev 2026
-
Abstract
Web security is messy, complicated, and under constant evolution. Often, you even start wondering why certain issues cannot be solved by the browser directly.
In this session, we investigate the security model of the web. We learn how browsers think about security, and how we can leverage that to build more secure applications. We explicitly focus on new browser features and how they can be used. Examples include the sanitization API, new cookie prefixes, as well as features focusing on script integrity. This session will give you an up-to-date understanding of browser security in the modern age.
Handouts available for this lecture
DownloadChapters
- Introduction and updated web security model
- Origins and the Same-Origin Policy
- Origin isolation as a security boundary
- Sites, eTLD+1, and the public suffix list
- Schemeful same-site and site isolation
- Cookies as browser-managed authentication state
- Secure and HttpOnly cookie flags
- Cookie tossing and session fixation
- Cookie prefixes and best practices
- Preventing client-side XSS
- Safe DOM APIs and sanitization
- Built-in Sanitizer and setHTML APIs
- Remote script risks and Subresource Integrity
- Enforcing SRI with Integrity Policy
- CSP hash reporting and key takeaways
In-person course
Philippe De Ryck taught at previous editions of SecAppDev
SecAppDev is an immersive course in secure application development, running annually since 2005. World-renowned faculty from industry and academia deliver in-depth 90-minute lectures and full-day workshops in an intimate setting, typically in early June.
More about SecAppDev