Vue.js Live Conference

Vue.js London Live 2021

Frontend frameworks like Vue are vulnerable to unsanitized inputs to execute malicious code. The patterns that allow for this are generally understood, but there are still some cases when your apps might still be at risk. Learn how you can implement automated application security to keep your apps safe. <a href="https://www.froala.com/wysiwyg-editor?pb=1"> </a>

How Developers Can Use Automated App Security Testing To Protect Vue Apps

Hey everybody, my name is Nick Teets and I'm a front end engineer at Stackhawk and today I'm going to tell you how developers can use automated application security testing to protect their Vue apps. A bit about me, I am a front end engineer so I must admit I do get emotional over fonts. I'm also the co-organizer of the Jamstack Denver meetup where we talk about everything from headless CMS to static site generation. And when I'm not busy jamming or tearing up over Helvetica, I'm a musician here in Denver. Today I'm going to tell you what it means to shift left, I'm going to show you an example of a cross site scripting vulnerability in a Vue app, and then I'm going to give you the tools that you need to find these types of vulnerabilities before you hit production. So what does it mean to shift left? Simply put, we're moving the tools of the software development lifecycle earlier in the process. There's a bunch of different types of security tools that you can use now when you're checking into your develop branch or your feature branch that will help you find security vulnerabilities. Things like secret scanning or the idea that we should be obfuscating API keys that we use to communicate with third party services. Software composition analysis, which is taking a look at the open source modules that you use to run your app and find vulnerabilities there. We have static application security testing, which looks at the actual code and text files of your repository to find vulnerabilities. And lastly, dynamic application security testing. This is what StackHawk's really good at, is we take a running instance of your app, whether it's in the pipeline or in local development, and finds vulnerabilities the same way that a bad actor may exploit your app. So let's jump into our example of our Vue app with cross-site scripting. So here we have FontTalk. This is a place where users can log into a message board and talk about fonts. And of course, we're going to give them the ability to style the text that they post on this message board. So Jane is going to start the conversation and say, y'all like fonts? We're going to wrap this in a bold tag to really emphasize that we're here to talk about fonts, of course. And we're going to post it. And you can see that we got the bold text in there. The message is available for everyone to see. But then Jane's going to follow it up with another post. We're going to emphasize the beautiful here. But we're also going to include this image tag. We're going to hide this from the user. And when this image tag loads, we're going to post sensitive account information to a bucket that we've set up on a third-party service.
So let's go ahead and save this note. And you may not notice something as a user that's not too savvy on the web. But if you inspect this bit, you can see that here's our image tag, which is hidden, that is hitting our third-party service with sensitive account information. So let's go ahead and log out as Jane. And we're going to log in as Bob. And Bob gets here, and he sees there's some good conversation about fonts. And he says, yeah, fonts are cool. And then Bob's going to leave the chat because maybe they're not a message board person. But what he doesn't know is that that cross-site scripting has now hit his account. If we go to this pipe dream, this bucket, this endpoint that we set up, we can see that that image tag sent Bob's confidential information over here so our bad actor Jane can see it. So now she can log in and post as Bob or maybe steal his credit card information if that sort of system was implemented on our app, which obviously, that's no good. So what can we do in the code to stop this from happening? One thing that we could do is go to our notes list. And instead of using vHTML, which uses that inner HTML method on our element, we can go ahead and just render the information in this note, the actual value. And so if we check that out, we can see that we've exposed these HTML tags that people were putting into our message board. So here's that bad image tag that's sending that information. But this is kind of removing some of the features from our cool message board about fonts. So that's not the way to go. Let's use this sanitize HTML library that you could scan with SCA, of course, to remove some of that bad HTML while allowing our users to still style their posts. So if we inspect this element, we can see that that malicious image tag has been removed from our post. And so things seem to be working. Now there's one last thing that we could do kind of as a frontline against cross-site scripting attacks, and that's adding the CSP header. So if we go to our terminal, we're going to run a StackHawk scan. Now this would obviously be implemented in your CICD pipeline every time you check code in. So while we're running that scan, we'll go over to the StackHawk platform to see what a finished scan looks like. Here's our app that we've already registered.
And if we click into this, we can see that there's a couple CSP header findings or vulnerabilities that we've discovered.

And so when we click into this, we are given the ability to triage or mark as false positive or risk accepted for these different types of vulnerabilities.

And we also provide a little bit of educational text about what the content security policy means.

And so using a tool like StackHawk, you can see what some of these vulnerabilities are before you hit production because you're running this in a pipeline.

And I'd love to tell you more about security and VLAPS and StackHawk, but we're running out of time.

So we're just going to play the thank you slide.

Learn more about StackHawk at stackhawk.com.

The blog post that I got inspiration for this Vue example is available at this link below.

And if you want to bug me on Twitter, I am nicktex on Twitter.

You know, drop by, tell me you love the presentation.

Let's talk about music or security or JavaScript.

Thank you to Vue for having me.

Thank you for watching.

And this has been awesome.

We'll see you later.

Bye bye.

Nick Teets

We're bringing free articles, videos, courses, and tutorials to help you learn all about ReactJS, whether you're a beginner or a pro. Introduced in 2011, the framework has become essential for web and mobile developers alike, enabling modern apps by look and function. And while other JS tools have expanded or revised its original notions, React's popularity is still the one to beat.

React is a powerful JavaScript library for building user interfaces. Learn more about React with our comprehensive talks, workshops, tutorials and presentations. Our experts will help you understand the fundamentals of React, as well as advanced concepts such as state management, routing, performance optimization and more. With our resources, you’ll be able to create stunning web applications with React and take your development skills to the next level.

React Talks, Workshops, Tutorials and Presentations for JavaScript Developers

Testing is a crucial albeit difficult part of software delivery. Make sure your JavaScript apps are always spotless with the following compilation of free online tutorials, courses, and talks from our conferences. They'll take you on a journey from basics to advanced methods and even philosophical questions about testing.

This page contains talks, workshops, tutorials and presentations about testing for JavaScript developers. Learn the best practices of testing code, how to design tests that are most effective, and how to debug problems in your code. Discover how to use automated testing tools, such as Jest and Mocha, to make sure your code is working correctly. Get answers to your questions on topics like unit testing, integration testing, end-to-end testing, and more. With these resources, you can become an expert in testing JavaScript code.

Testing Talks, Workshops, Tutorials, and Presentations for JavaScript Developers

Coding is like a piece of art — in its ideal state, it should be both functional and beautiful. But how to reach that point? Whether you’d like to make your JavaScript code cleaner or just discover how seasoned developers deal with debugging or building a product, the following tutorials will show you how to include best practices in your daily routine.

The page contains talks, workshops, tutorials and presentations about the best practices for JavaScript developers. Learn from experienced professionals about techniques and strategies to optimize your code, debug errors, and enhance your development skills. Get up-to-date information on the latest trends in the JavaScript ecosystem, such as frameworks, libraries, and tools. Discover the best practices for writing efficient, maintainable, and secure code. Take advantage of our interactive sessions and hands-on tutorials that will help you become a better JavaScript developer.

Best Practices in JavaScript Development: Talks, Workshops, Tutorials and Presentations

Did you know that TypeScript lets you write JavaScript the way you really want to? Explore the variety of Typescript courses we compiled from our speakers and collaborators and find out what you can do with this language and how it improves the development experience.

This page contains talks, workshops, tutorials and presentations about Typescript. Learn from experienced JavaScript developers how to get started with Typescript and how to use it in your projects. Get the latest tips and tricks for coding with Typescript and find out how to optimize your code for maximum performance. Discover how to create efficient and maintainable applications with Typescript and take your development skills to the next level.

Learn Typescript: Talks, Workshops, Tutorials & Presentations for JavaScript Developers

Design systems in web design are a set of interconnected design components that are organized in a systematic manner. They provide a consistent visual language and design guidelines for creating digital products, enabling designers to work faster and more efficiently. Design systems also promote better collaboration among team members and help to maintain brand consistency.

Design systems are an essential part of modern web development, and this page contains talks, workshops, tutorials and presentations about design systems for JavaScript developers. From understanding the basics of design systems to mastering advanced techniques, youll find the resources you need to become an expert in creating and maintaining design systems. Learn how to create a unified visual language, define components and use them across multiple projects, and keep your design system up to date as your project evolves. Our talks, workshops, tutorials and presentations will give you the knowledge and tools you need to create and maintain robust design systems.

Design Systems: Talks, Workshops, Tutorials & Presentations for JavaScript Developers

They are independent, reusable, and they let you build fast and eye-catching apps. Obviously, we’re talking about React components, which allow you to take your work to a whole another level. Tune in to the free online tutorials and masterclasses below to learn how to get the most out of their functionality and styling.

This page contains talks, workshops, tutorials and presentations about React Components. Learn the fundamentals of building components with React, from creating and styling custom components to efficiently managing data flow. Discover how to create dynamic user interfaces with reusable components and explore techniques for debugging and testing your application. Get up-to-date with the latest features of React, including hooks and suspense, and learn best practices for deploying and maintaining your React applications.

React Components: Talks, Workshops, Tutorials and Presentations

Feeling like boosting up your career? In this section, you'll find free JavaScript courses, tutorials, and coding lessons to help you stay up-to-date with the latest developments in the JS ecosystem and take you from basic to advanced. Dive into it, and you'll find out that the world's most popular programming language is easy to learn.

Welcome to the JavaScript Learning Portal! Here you will find a variety of talks, workshops, tutorials and presentations about JavaScript. Whether youre a beginner looking to learn the basics or an experienced developer looking to stay up-to-date on the latest trends in the language, this portal has something for everyone. We have organized our content into different categories so you can easily find what you need. Explore our selection of talks, workshops, tutorials and presentations today and start learning more about JavaScript!

JavaScript Talks, Workshops, Tutorials & Presentations - Learn JavaScript from the Experts!

JS tooling is a term used to describe the tools and processes used to develop applications in JavaScript. This includes frameworks, libraries, build systems, task runners, and other tools that help developers create, test, and deploy their applications. We have talks and workshops on this topic to help students learn how to use these tools effectively and efficiently.

This page contains talks, workshops, tutorials and presentations about js tooling - the most up-to-date JavaScript tools and techniques for developers. Learn how to set up a JavaScript development environment, create custom scripts and build applications with the latest technologies. Discover the best practices for using popular tools like Gulp, Grunt, Webpack, Babel and more. Get tips on debugging and troubleshooting common problems. Whether you are a beginner or an experienced developer, these resources will help you get the most out of your JavaScript tooling.

Exploring JS Tooling: Talks, Workshops, Tutorials and Presentations

Managing the state of a browser-based JS application is tough — but it doesn’t have to. With tips and workarounds from our speakers’ tutorials and courses on JavaScript state management, you’ll find that even the most tedious tasks can be easy if you follow a few simple principles to avoid the most common pitfalls.

State management is a key concept in software development, particularly for JavaScript developers. This page contains talks, workshops, tutorials and presentations to help you understand state management and how it can be used to create powerful web applications. Learn the fundamentals of state management such as React, Redux, MobX and more, as well as best practices for managing state in your own projects. Get tips and tricks from experienced developers on how to use state management to build efficient and maintainable code. With this page, you will have all the resources you need to become an expert in state management.

State Management Talks, Workshops, Tutorials & Presentations for JavaScript Developers

Code quality is a measure of how well written, organized, and maintainable a piece of code is. It is important for any programming language, but especially so for JavaScript due to its dynamic nature. Good code quality means that the code is easy to read and understand, has good structure and organization, and is easy to modify or extend. It also means that the code is secure, efficient, and performs as expected. In short, it is the practice of writing code that is clean, efficient, and bug-free.

The page contains talks, workshops, tutorials and presentations about code quality. Our content is designed to help JavaScript developers improve their coding skills, understand the importance of code quality, and develop better coding practices. We provide a range of resources to help developers learn how to write clean, efficient code that meets industry standards. Whether youre just starting out or are an experienced coder, our content will help you level-up your coding game.

Improving Code Quality: Talks, Workshops, Tutorials & Presentations for JavaScript Developers

DevTools is a set of web development tools built into the Chrome browser. They allow developers to inspect and debug HTML, CSS, and JavaScript code on any web page. DevTools provides access to the Document Object Model (DOM), allowing developers to view the structure of a page and make changes to it in real-time. It also provides features such as network performance analysis, JavaScript debugging, and memory profiling, which help developers optimize their code.

DevTools Talks, Workshops, Tutorials and Presentations

Discover the power of DevTools with our range of talks, workshops, tutorials and presentations. Our experts will help you understand how to use DevTools to debug, inspect, and improve your code. Learn best practices for debugging, profiling, and optimizing your JavaScript applications. Get up-to-date on the latest trends in DevTools and find out how they can help you become a better developer. Whether youre a beginner or an experienced programmer, we have something for everyone. Come join us and explore the world of DevTools!

DevTools Talks, Workshops, Tutorials & Presentations: Get the Most Out of Your JavaScript Development!

Web development is the process of creating websites, applications and other online services. It involves a combination of coding languages such as HTML, CSS, JavaScript and others to create an interactive user experience. The goal of web development is to create a website or application that is fast, secure, and easy to use. Web developers must understand how to design, build and maintain websites while also considering the user experience and making sure the code is optimized for performance.

The page contains talks, workshops, tutorials and presentations about web development for JavaScript developers. Learn the fundamentals of web development and use JavaScript to create dynamic and interactive websites. Our experts will guide you through the process from the basics of HTML and CSS to more advanced topics such as AJAX, jQuery, and Node.js. Get the skills you need to become a successful web developer and take your career to the next level.

Web Development Talks, Workshops, Tutorials, and Presentations

CSS stands for Cascading Style Sheets. It is a language used to style HTML elements on a web page. CSS is used to control the appearance of text, images, and other content on a web page. It can be used to set the font size, color, background, margins, padding, and more. CSS is an essential part of modern web development, and it is important for JavaScript developers to understand how to use it.

This page is a comprehensive resource for learning about CSS. Here you will find talks, workshops, tutorials, and presentations on the fundamentals of styling webpages with CSS. Our content is designed to help JavaScript developers gain the skills they need to create visually appealing and well-structured websites. We cover topics such as selectors, properties, values, inheritance, and more. With our resources, you can quickly master the basics of CSS and start building great webpages.

CSS Talks, Workshops, Tutorials & Presentations for JavaScript Developers

While ReactJS is one of the most popular frameworks out there, it still has its limits. That’s where React Hooks come to play: they are special functions that expand the abilities of functional components. Discover the following talks and workshops that will take you through React Hooks fundamentals and advanced techniques to ensure you’re always on top of your game.

React Hooks is a powerful feature of React that allows developers to write components with fewer lines of code. On this page, youll find talks, workshops, tutorials and presentations about React Hooks, so you can learn more about this important feature and become a better JavaScript developer. Weve gathered the best resources from experts in the field, so you can quickly get up to speed with React Hooks and start using them in your own projects.

React Hooks: Talks, Workshops, Tutorials and Presentations for JavaScript Developers

Fullstack is a term used to describe a developer who is knowledgeable in every layer of web development. This includes the front-end (client side) code such as HTML, CSS, and JavaScript, as well as the back-end (server side) code such as databases, server-side languages, and APIs. A fullstack developer can develop entire web applications from start to finish, including database design, user interface design, and coding.

Fullstack can be a daunting concept for JavaScript developers, but it doesnt have to be. Our collection of talks, workshops, tutorials, and presentations will help you understand the fundamentals of fullstack development, so you can start building powerful applications quickly and efficiently. With our comprehensive resources, youll learn how to use both backend and frontend technologies to create modern web apps, mobile apps, and more. Whether youre just getting started or looking to take your skills to the next level, our fullstack content will give you the knowledge and confidence you need to succeed.

Fullstack Talks, Workshops, Tutorials and Presentations for JavaScript Developers

Vue 3 is the upcoming major version of Vue.js, an open-source JavaScript framework for building user interfaces and single-page applications. It provides a core library that focuses on the view layer only, making it easy to integrate with other libraries and existing projects. Vue 3 will feature improved performance, better TypeScript support, improved Composition API, and Fragment Support. Additionally, it will have a new version of the Vue CLI and a new compiler architecture for improved build times.

Vue 3 is the latest version of Vue.js, a popular JavaScript framework for building user interfaces. This page contains talks, workshops, tutorials and presentations about Vue 3 and its features. Learn from experienced JavaScript developers as they discuss the best practices for working with Vue 3 and how to use it to create dynamic, interactive web applications. Get up to speed quickly on the latest version of Vue and find out how to make the most of its powerful features.

Mastering Vue 3: Talks, Workshops, Tutorials and Presentations for JavaScript Developers

Frontend refers to the part of a website or application that users interact with. It is typically built using HTML, CSS and JavaScript to create an interface that allows users to view and interact with content. Frontend developers are responsible for creating the visual elements of a website or application, such as layout, styling, animation, and user interaction. This includes designing how a page looks, how it responds to different events, and how it interacts with the user.

The page contains talks, workshops, tutorials and presentations about frontend and is designed for JavaScript developers looking to improve their knowledge and skills in this area. Here you can find the latest insights, tools and techniques to help you stay up-to-date with the ever-changing frontend landscape. Whether youre a beginner or an experienced developer, youll find something to help you become a better frontend engineer.