731: Client side security, XSS attacks & CSP with Stripe’s Alex Sexton

731: Client side security, XSS attacks & CSP with Stripe’s Alex Sexton

Scott and Wes are joined by security expert, Alex Sexton of Stripe to cover all things: client security, XSS, attack vectors, and CSP (content security policy). Show Notes 00:00 Welcome to Syntax! 00:31 Brought to you by Sentry.io. 00:57 Who is Alex Sexton? 04:44 Stripe dashboard is a work of art. 05:08 Tell us about the design system. React Aria 08:59 Who develops the iOS app? 09:50 Stripe’s CSP (content security policy). 12:50 What even is a content security policy? Content Security Policy explanation 13:57 Douglas Crockford of Yahoo on security. Douglas on GitHub 15:13 Security philosophy. 16:59 What about inline styles and inline JavaScript? 19:41 How do we safely set inline styles from JS? 20:20 Setting up with meta tags. 22:52 What are common situations that require security exceptions? 26:24 Potential damage with inline style tags. 32:45 Looping vulnerabilities. 36:32 What about JavaScript injection? 37:09 Myspace Samy Worm. Myspace Samy Worm Wiki Sentry.io Security Policy Reporting 42:02 Does a CSP stop code from running in the console? 43:28 What are some general security best practices? 46:35 Strategies for rolling out a CSP. 51:49 Final tip, Strict Dynamic. Strict Dynamic 56:36 Where does the CSP live within Stripe? Original Black Friday story 59:35 One last story. 01:01:20 Sick Picks + Shameless Plugs Sick Picks + Shameless Plugs Alex: Wes Bos’ Instagram Hit us up on Socials! Syntax: X Instagram Tiktok LinkedIn Threads Wes: X Instagram Tiktok LinkedIn Threads Scott:X Instagram Tiktok LinkedIn Threads Randy: X Instagram YouTube Threads

Avsnitt(990)

966: A Look Back at Web Dev in 2025

966: A Look Back at Web Dev in 2025

Wes and Scott revisit their 2025 web development predictions, grading hits and misses across AI, browsers, frameworks, CSS, and tooling. From Temporal and AI coding agents to React, Vite, and vanilla ...

24 Dec 202556min

965: Baseline 2025 Features web gained in 2025

965: Baseline 2025 Features web gained in 2025

Scott and Wes break down the biggest web platform features that reached Baseline in 2025, separating the genuinely useful APIs from the niche and forgettable ones. From same-document view transitions ...

22 Dec 202526min

964: Markdown as a CMS is a bad idea

964: Markdown as a CMS is a bad idea

In this potluck episode of Syntax, Wes and Scott answer your questions about keyboard shortcuts, choosing frameworks in the age of AI, markdown vs CMSs, backup strategies, moving countries for work, s...

17 Dec 20251h 3min

963: Hardware Hacking with Matt Brown

963: Hardware Hacking with Matt Brown

Scott and Wes chat with YouTuber and security consultant Matt Brown about breaking into IoT devices, extracting firmware, and decoding the hidden tech inside everyday gadgets. Matt shares his methods,...

15 Dec 202558min

962: The Home Server / Synology Show

962: The Home Server / Synology Show

Wes and Scott talk about their evolving home-server setups—Synology rigs, Mac minis, Docker vs. VMs, media servers, backups, Cloudflare Tunnels, and the real-world pros and cons of running your own ha...

10 Dec 202535min

961: Keeping Up With The Fast and Furious Web

961: Keeping Up With The Fast and Furious Web

Scott and CJ go live from JS Nation NYC to talk about how developers can actually stay current without drowning in the constant churn of new tools and trends. They break down how to see through the fl...

8 Dec 202528min

960: Reacting to the Weird + Creative Corners of the Web

960: Reacting to the Weird + Creative Corners of the Web

Wes and Scott talk about the weird, creative corners of the web—from live-coded music with Strudel and wild Hydra visuals to shader wizardry, projection-mapping art, fully synced Christmas lights, and...

3 Dec 202527min

959: TypeScript on the GPU with TypeGPU creator Iwo Plaza

959: TypeScript on the GPU with TypeGPU creator Iwo Plaza

Scott and CJ sit down live at JSNation NYC with Iwo Plaza, creator of TypeGPU, to dig into how WebGPU is unlocking a new wave of graphics and compute power on the web. They chat about shader authoring...

1 Dec 202525min

Populärt inom Politik & nyheter

svenska-fall
p3-krim
aftonbladet-krim
rss-krimstad
spar
flashback-forever
fordomspodden
rss-sanning-konsekvens
rss-vad-fan-hande
motiv
aftonbladet-daily
rss-krimreportrarna
krimmagasinet
rss-frandfors-horna
politiken
sydsvenskan-dok
grans
rss-flodet
rss-aftonbladet-krim
kungligt