Building Secure Twitter Apps

Web App Security and Twitter and Twitter ,[object Object],[object Object],[object Object]

Common Issues ,[object Object],[object Object],[object Object],[object Object],[object Object]

SQL Injection ,[object Object],[object Object],[object Object],[object Object]

...in action http://xkcd.com/327/

Cross-Site Scripting ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Real-World Dangers ,[object Object]

Web 2.0 Frameworks ,[object Object],[object Object],[object Object],[object Object],[object Object]

CSRF ,[object Object],[object Object],[object Object]

CSRF++ ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

CSRF GET ,[object Object],[object Object],[object Object],[object Object],[object Object]

CSRF POST ,[object Object],<form name=”csrf” action=” http://x.com/delete.php ” method=”POST”> <input type=”hidden” name=”id” value=”123”> </form> <script>document.csrf.submit()</script>

Information Disclosure ,[object Object],[object Object]

Retrieve Username $.getJSON(" http://twitter.com /statuses/user_timeline?count=1&callback=? ", function(data) { alert("Username is: " + data[0].user.screen_name ) }); {"text":"Pretty sure humans have kneecaps so we can slam them into tables. *ow*","truncated":false, "user" :{"following":null,"time_zone":"Pacific Time (US & Canada)","description":"Prof. Computer Security Consultant with a passion for breaking things and generating statistics (see http:tweetstats.com and http:ratemytalk.com).", "screen_name":"dacort" ,"utc_offset":-28800,"profile_sidebar_border_color":"87bc44","notifications":null,"created_at":"Thu Dec 21 07:14:05 +0000 2006","profile_text_color":"000000","url":"http:dcortesi.com","name":"Damon Cortesi","statuses_count":21385,"profile_background_image_url":"http:static.twitter.comimagesthemestheme1bg.gif","followers_count":4441,"protected":false,"profile_link_color":"A100FF","profile_background_tile":false,"friends_count":1775,"profile_background_color":"000000","verified":false,"favourites_count":202,"profile_image_url":"http:s3.amazonaws.comtwitter_productionprofile_images90802743Famous_Glasses_normal.jpg","location":"Seattle, WA","id":99723,"profile_sidebar_fill_color":"e0ff92"},"in_reply_to_status_id":null,"created_at":"Mon Jul 27 21:37:53 +0000 2009","in_reply_to_user_id":null,"favorited":false,"in_reply_to_screen_name":null,"id":2877957719,"source":"<a href=amp;quot;http: www.atebits.com amp;quot;>Tweetie<a>"}

Protected Users ,[object Object],[object Object],[object Object]

Let’s have some fun... ,[object Object]

Mitigation ,[object Object],[object Object],[object Object]

Sanitization/Encoding ,[object Object],[object Object],[object Object],[object Object],[object Object]

Some other things... ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

One last thing ,[object Object],[object Object],[object Object],[object Object],[object Object]

Third Parties ,[object Object],[object Object],[object Object],[object Object]

Building Secure Twitter Apps

Empfohlen

Empfohlen

Weitere ähnliche Inhalte

Was ist angesagt?

Was ist angesagt? (20)

Andere mochten auch

Andere mochten auch (20)

Ähnlich wie Building Secure Twitter Apps

Ähnlich wie Building Secure Twitter Apps (20)

Kürzlich hochgeladen

Kürzlich hochgeladen (20)

Building Secure Twitter Apps