XSS is dead – Browser Security Features that Eliminate Bug Classes

The talk starts from the view that application security often stays stuck in a reactive cycle, fixing individual bugs as bounty reports and pentests surface them. Cross-site scripting still ranks near the top of the most rewarded findings despite being an old flaw. The speaker argues for layered, browser-enforced defenses so that a missed output encoding step does not automatically become exploitable.

The middle walks through concrete browser features. HttpOnly cookies keep injected script from reading session tokens. Sec-Fetch-Metadata headers reveal whether a request is cross-site, so a reverse proxy can reject risky cross-site requests. A strict Content Security Policy is presented as the strongest XSS control, and the recommended rollout begins in report-only mode, reviewing violations and tightening the policy gradually. Trusted Types is shown policing dangerous DOM sinks, with a sanitizing wrapper around a library such as DOMPurify and a polyfill for browsers lacking support. A case study describes measuring header adoption across many services at the proxy layer, producing a per-service scorecard.

The closing takeaways urge moving from reactive patching to secure-by-default configuration, automating CSP hashes and nonces in build pipelines, and tracking coverage across an estate. In audience Q&A the speaker noted that few tools generate CSPs well, pointing to a Firefox add-on and Google's CSP evaluator while acknowledging that custom CI scripts are often needed.