First up today is @fransrosen on Attacking Modern Web Technologies. #NDCOslo
AppCache can be exploited to redirect users to malicious content.
Service Workers are also a potential attack vector, though there are more limitations.
Allowing direct uploads to S3 buckets (and similar) secured by Upload Policies is easy to accidentally make insecure.
For example, omitting the key prefix from the policy allows the user to overwrite any file in the bucket. This could even be used to set up an attack using Service Workers.
Be careful about sending signed bucket URLs back to the client. These need to be validated to make sure users are not able to overwrite or read files that they shouldn't be able to access.
