Building Secure Twitter Apps

Web App Security and Twitter and Twitter ,[object Object],[object Object],[object Object]

Common Issues ,[object Object],[object Object],[object Object],[object Object],[object Object]

SQL Injection ,[object Object],[object Object],[object Object],[object Object]

...in action http://xkcd.com/327/

Cross-Site Scripting ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Real-World Dangers ,[object Object]

Web 2.0 Frameworks ,[object Object],[object Object],[object Object],[object Object],[object Object]

CSRF ,[object Object],[object Object],[object Object]

CSRF++ ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

CSRF GET ,[object Object],[object Object],[object Object],[object Object],[object Object]

CSRF POST ,[object Object],<form name=”csrf” action=” http://x.com/delete.php ” method=”POST”> <input type=”hidden” name=”id” value=”123”> </form> <script>document.csrf.submit()</script>

Information Disclosure ,[object Object],[object Object]

Retrieve Username $.getJSON(" http://twitter.com /statuses/user_timeline?count=1&callback=? ", function(data) { alert("Username is: " + data[0].user.screen_name ) }); {"text":"Pretty sure humans have kneecaps so we can slam them into tables. *ow*","truncated":false, "user" :{"following":null,"time_zone":"Pacific Time (US & Canada)","description":"Prof. Computer Security Consultant with a passion for breaking things and generating statistics (see http:tweetstats.com and http:ratemytalk.com).", "screen_name":"dacort" ,"utc_offset":-28800,"profile_sidebar_border_color":"87bc44","notifications":null,"created_at":"Thu Dec 21 07:14:05 +0000 2006","profile_text_color":"000000","url":"http:dcortesi.com","name":"Damon Cortesi","statuses_count":21385,"profile_background_image_url":"http:static.twitter.comimagesthemestheme1bg.gif","followers_count":4441,"protected":false,"profile_link_color":"A100FF","profile_background_tile":false,"friends_count":1775,"profile_background_color":"000000","verified":false,"favourites_count":202,"profile_image_url":"http:s3.amazonaws.comtwitter_productionprofile_images90802743Famous_Glasses_normal.jpg","location":"Seattle, WA","id":99723,"profile_sidebar_fill_color":"e0ff92"},"in_reply_to_status_id":null,"created_at":"Mon Jul 27 21:37:53 +0000 2009","in_reply_to_user_id":null,"favorited":false,"in_reply_to_screen_name":null,"id":2877957719,"source":"<a href=amp;quot;http: www.atebits.com amp;quot;>Tweetie<a>"}

Protected Users ,[object Object],[object Object],[object Object]

Let’s have some fun... ,[object Object]

Mitigation ,[object Object],[object Object],[object Object]

Sanitization/Encoding ,[object Object],[object Object],[object Object],[object Object],[object Object]

Some other things... ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

One last thing ,[object Object],[object Object],[object Object],[object Object],[object Object]

Third Parties ,[object Object],[object Object],[object Object],[object Object]

Building Secure Twitter Apps

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Viewers also liked

Viewers also liked (20)

Similar to Building Secure Twitter Apps

Similar to Building Secure Twitter Apps (20)

Recently uploaded

Recently uploaded (20)

Building Secure Twitter Apps