node.js, socket.io, express and other technologies are simply awesome for the real time web. They are enabling front end javascript developers to take their skills to the server. This does not come without a price. Adam will discuss his experiences and thoughts on securing real time systems built on some of these technologies, the talk hopes to promote positive discussion not finger pointing of how we as a community can avoid the pitfalls of the past and make the realtime web a safer place. Adam is the co-founder of nGenuity where he focuses on helping developers ship secure code.

1. Old Problems,
New Tools
Keeping It Realtime // 2011 // Adam Baldwin

2. Hi. I’m Adam
Keeping it Realtime // @adam_baldwin

3. Keeping it Realtime // @adam_baldwin

4. Introduction
Co-Founder of nGenuity
Penetration Tester
evilpacket.net
Keeping it Realtime // @adam_baldwin

5. Keeping it Realtime // @adam_baldwin

6. State of Things
Keeping it Realtime // @adam_baldwin

7. secure Defaults
Keeping it Realtime // @adam_baldwin

8. A security lesson: instead of
action and safe_action,
your API should be action
and unsafe_action.
Safe should be the default /
via @jezdez
Keeping it Realtime // @adam_baldwin

9. Better Examples
(docs that donʼt suck)
Keeping it Realtime // @adam_baldwin

10. Socket.io
Keeping it Realtime // @adam_baldwin

11. Set Origins by Default
Log Warnings
Better Examples
Keeping it Realtime // @adam_baldwin

12. Express, et al
Keeping it Realtime // @adam_baldwin

13. CSRF Protection by Default
Better Examples / Improved Boilerplate
Anti-Evil Headers™ on by Default
Keeping it Realtime // @adam_baldwin

14. Magical headers are magical.
X-FRAME-OPTIONS
Content Security Policy (CSP)
Keeping it Realtime // @adam_baldwin

15. Jade, et al
Keeping it Realtime // @adam_baldwin

16. &<>‘“
Keeping it Realtime // @adam_baldwin

17. If you fell asleep;
-Set socket.io origins
-Properly authorize sockets
-Use CSRF tokens
-Contextual Output encoding
-Do all this by default
-Write better docs
Keeping it Realtime // @adam_baldwin

18. Keeping it Realtime // @adam_baldwin

19. Questions?
adam@ngenuity-is.com // @adam_baldwin