Securing Frontends at Scale: Paving Our Way to Post-XSS World
Google's engineering blueprint for eliminating cross-site scripting at scale using compile-time and runtime frontend protections.
Summary
Evolving Beyond Cross-Site Scripting
Cross-site scripting (XSS) remains one of the most persistent classes of web application vulnerabilities. Eliminating XSS across massive codebases requires systemic architectural defenses rather than relying solely on developer vigilance.
Compile-Time and Runtime Protections at Google
Google implemented integrated compile-time type enforcement and runtime sanitization mechanisms across hundreds of products serving billions of users. These automated guardrails prevent injection flaws by design while maintaining developer productivity.
Lessons for Large-Scale Frontend Defense
Deploying scalable frontend security frameworks provides key insights into API design, deprecation strategies, and the technical roadmap toward a post-XSS web platform.
Related talks
OWASP Foundation·47 min
AppSec EU 2017 Don't Trust The DOM: Bypassing XSS Mitigations Via Script Gadgets by Sebastian Lekies
Security researchers examine technical aspects of AppSec EU 2017 Don't Trust The DOM: Bypassing XSS Mitigations Via Script Gadgets by Sebastian Lekies.
Main Stage·38 min
Zhengyu Liu · Jianjia Yu
Introduces Hulk, the first dynamic analysis tool to automatically detect and generate exploit payloads for complex DOM Clobbering vulnerabilities at web scale.
App Sec Village·24 min
Peiyu Wang
Real-world attack vectors, threat modeling techniques, and vulnerability case studies for penetration testing decentralized Web3 applications.