You build applications using Generative AI and LLM frameworks for your JavaScript apps. Hurray! I sure hope you didn’t forget this tiny little thing called application security :-)​Join me in this session, where we uncover imminent security vulnerabilities from basics to hands-on live hacking and demonstrate real-world insecure JavaScript code mistakes as we hack in the IDE and unleash exploit payloads that compromise AI-generated code. You’ll learn and experience prompt injection, LLM agents with excessive access, code vulnerabilities introduced via IDE auto-suggest tools, and how LLM sources turn into an imminent security risk.

From the sinister injection flaws reminiscent of "Alien" to the terrifying specter of broken authentication akin to what "The Invisible Man" is capable of, we'll explore the most common security vulnerabilities in web development. But don't worry—we'll also shed light on solutions. If you dare, join us and learn how to conquer the darkness invited by your web applications.

Nowadays most of our code is opensource, and we use a large amount of it in our systems. But we need to keep an eye on those opensource components, as new vulnerabilities are discovered every day. What happens if we let our guard down? And what can we do to avoid it? In this presentation we take a look at a simple RCE vulnerability, how it can be exploited, sending pure (?) JSON to a server, in order to take control of it, in a live demo. After explaining what's happening, we then take a look at a free plugin to use directly in our IDE to prevent this, giving the power back to developers!

Single Page Applications appear simple at first sight. Web developers provide a superb user experience, and it is also relatively easy to implement token-based security in the browser. Yet this is against current best practices for browser-based apps, and security concerns can become a blocking issue. It is instead recommended to implement a Backend for Frontend (BFF), to reduce browser threats. Yet this often results in the adoption of website technologies to issue secure cookies, which can work against other web architecture goals. In this talk, I will show how a separation of web and API concerns can give you the best choices. In the talk, I will present the Token Handler Pattern — Curity's variation of the Backend For Frontend approach. I will show the open-source projects we created that facilitate the implementation of the pattern.