Presented at
LocoMocoSec 2019,
April 19, 2019, 9:15 a.m.
(45 minutes).
With the rise of Single Page Applications, we also see a paradigm shift in session management techniques. Instead of using server-side cookie-based sessions, many developers are shifting towards client-side state mechanisms, using JWT tokens an custom HTTP headers. There’s plenty of conflicting advice out there, discussing cookie security issues, Cross-Site Request Forgery, and XSS. So how can you make a sensible choice, and how will that impact the security of your application?
This talk will guide you in this choice. We dive into the technicalities behind these technologies, and the actual security impact of your choices. We’ll look at compatibility with current web security mechanisms. You will learn how to assess your past choices, and how to substantiate future decisions.
Presenters:
-
Philippe De Ryck
- Pragmatic Web Security
Ph.D., Founder of Pragmatic Web Security, Google Developer Expert.
Philippe De Ryck helps developers protect companies through better web security. As the founder of Pragmatic Web Security, he travels the world to train developers on web security and security engineering. His Ph.D. in web security from KU Leuven lies at the basis of his exceptional knowledge of the security landscape. Google recognizes Philippe as a Google Developer Expert for his work on security in Angular applications.
Links:
Similar Presentations: