JavaScript for Line of Business Applications

Modern web applications depend on a lot of auxiliary scripts which are often hosted on third-party CDNs. Should an attacker be able to tamper with the files hosted on such a CDN, millions of sites could be compromised. Web developers need a way to guarantee the integrity of scripts hosted elsewhere. 

This is the motivation behind a new addition to the web platform being introduced by the W3C: sub-resource integrity (http://www.w3.org/TR/SRI/). Both Firefox and Chrome have initial implementations of this new specification and a few early adopters such as Github are currently evaluating this feature.

Modern web apps are often single page web apps. The heavy HTML-generating backend is replaced by JavaScript, JavaScript frameworks like Backbone.js and templating languages like mustache.js or underscore.js. Data is transferred via RESTful JSON services. We are moving functionality normally implemented on the server to the browser. Sometimes we even implement the backend using JavaScript.
What kinds of security problems can occur if we do this incorrectly? How do we mitigate the security problems found in these applications?

JSMVCOMFG: To sternly look at JavaScript MVC and Templating Frameworks.

Spring Security, Spring Boot and Angular JS all have nice features for making it really easy to produce modern applications, so there is potentially a lot of value in making them work together very smoothly. Things to consider are cookies, headers, native clients, various security vulnerabilities and how modern browser technology can help us to avoid them. 

In this session we show how nice features of the component frameworks can be integrated simply to provide a pleasant and secure user experience. We start with a very basic single-server implementation and scale it up in stages, splitting out backend resources and authentication to separate services. The final state includes a simple API Gateway on the front end implemented declaratively using Spring Cloud, and using this we are able to neatly sidestep a lot of the problems people encounter securing a javascript front end with a distributed back end. 

Authentication

* How protect REST services

* API-Key

* Secret-key

* Signature

* Nonce, non-repuduation

* OAuth1 vs OAuth2

Authorization

* Profiles

* Stateless vs stateful

* HATEOAS

* Atom/RSS

This 49 minute talk covers several topics in JavaScript and web security, including secure password storage and authentication, SRP protocol, and common JavaScript security threats and injection techniques.