The Tangled Web A Guide to Securing Modern Web Applications

The Tangled Web is destined to be the definitive guide to web application security. Rather than simply enumerate known vulnerabilities or lay down a series of commandments from on high, famed security expert Michal Zalewski takes an in-depth look at how browsers actually work, how to leverage their features, and what pitfalls lurk in the shadows. An outgrowth of Zalewski's work on Google's online Browser Security Handbook, The Tangled Web sheds light on the uniqueness of the security challenges that engineers, developers, and users face on the Web today. The book opens with a detailed examination of browser security mechanisms, the historical reasons behind their design, and their security consequences. Subsequent chapters discuss the security aspects of specific web technologies, including URLs, HTTP, HTML, JavaScript, the same-origin policy, and HTML5. Readers looking for quick answers will appreciate the cheat sheets in each chapter, which outline the most commonly encountered problems and how to tackle them. An appendix offers a glossary of well-known implementation vulnerabilities.

Michal Zalewski is an internationally recognized information security expert with a long track record of delivering cutting-edge research. He is credited with discovering hundreds of notable security vulnerabilities and frequently appears on lists of the most influential security experts. He is the author of Silence on the Wire (No Starch Press), Google's "Browser Security Handbook," and numerous important research papers.

Preface and Acknowledgments
1. Security in the World of Web Applications
Part I: Anatomy of the Web
2. It Starts with A URL
3. Hypertext Transfer Protocol
4. Hypertext Markup Language
5. Cascading Style Sheets
6. Browser-Side Scripts
7. Non-HTML Document Types
8. Content Rendering with Browser Plug-Ins
Part II: Browser Security Features
9. Content Isolation Logic
10. Origin Inheritance
11. Life Outside Same-Origin Rules
12. Other Security Boundaries
13. Content Recognition Mechanisms
14. Dealing with Rogue Scripts
15. Extrinsic Site Privileges
Part III: A Glimpse of Things to Come
16. New and Upcoming Security Features
17. Other Browser Mechanisms of Note
18. Common Web Vulnerabilities
Epilogue
Notes
Index