Название: Grokking Web Application Security (Final Release)
Автор: Malcolm McDonald
Издательство: Manning Publications
Год: 2024
Страниц: 336
Язык: английский
Формат: pdf (true)
Размер: 41.1 MB

When you launch an application on the web, every hacker in the world has access to it. Are you sure your web apps can stand up to the most sophisticated attacks?

Grokking Web Application Security is a brilliantly illustrated and clearly written guide that delivers detailed coverage on:

How the browser security model works, including sandboxing, the same-origin policy, and methods of securing cookies
Securing web servers with input validation, escaping of output, and defense in depth
A development process that prevents security bugs
Protecting yourself from browser vulnerabilities such as cross-site scripting, cross-site request forgery, and clickjacking
Network vulnerabilities like man-in-the-middle attacks, SSL-stripping, and DNS poisoning
Preventing authentication vulnerabilities that allow brute forcing of credentials by using single sign-on or multi-factor authentication
Authorization vulnerabilities like broken access control and session jacking
How to use encryption in web applications
Injection attacks, command execution attacks, and remote code execution attacks
Malicious payloads that can be used to attack XML parsers, and file upload functions

Grokking Web Application Security teaches you how to build web apps that are ready for and resilient to any attack. It’s laser-focused on what the working programmer needs to know about web security, and is fully illustrated with concrete examples and essential advice from author Malcolm McDonald’s extensive career. You’ll learn what motivates hackers to hack a site, discover the latest tools for identifying security issues, and set up a development lifecycle that catches security issues early. Read it cover to cover for a comprehensive overview of web security, and dip in as a reference whenever you need to tackle a specific vulnerability.

Web application security is a curious subject area, in that every programmer (even fresh out of boot camp or with a recent computer science degree in hand) will have a fair knowledge of it, but we tend to feel (quite correctly) that we should know a little bit more. Doing your own research on the web can feel like walking into a disorganized library and picking up random texts, hoping to gain some good insights. Furthermore, nobody loves going to their boss and admitting that they have gaps in their knowledge, so we tend to be a little insecure about what we might not know.

Launching a web application on the internet is a daunting task. The steps you take along the road to deploying a web app can be onerous: designing and coding your web pages, adding interactivity using jаvascript, implementing the backend services and connecting them to a data store, choosing a hosting platform, and registering a domain name. The result is worthwhile, of course: your website will be available to billions of users immediately, thanks to the magic of the internet.

Not all these users have good intentions, though. The internet hosts a complex ecosystem of scripts, bots, and hackers who will try to abuse any security flaws in your web app for nefarious ends. This is probably the most disconcerting aspect of web development: after all the work you put into building your web application, someone will immediately come along to kick the tires and scratch the paintwork. Because you are reading this book, you are likely a developer who is wary of these security risks and who wants to learn how to protect yourself. This book is a comprehensive guide to web security: you will learn how to secure your web apps in the browser, on the network, on the server, and at code level. I will also introduce the key security principles that can be applied at each level of abstraction.

About the technology

Security is vital for any application, especially those deployed on the web! The internet is full of scripts, bots, and hackers who will seize any opportunity to attack, crack, and hack your site for their own ends. It doesn’t matter which part of a web app you work with—security vulnerabilities can be found in both frontends and backends. Luckily, this comprehensive guide is here with no-nonsense advice that will keep your web apps safe.

About the book

Grokking Web Application Security teaches you everything you need to know to secure your web applications in the browser, on the server, and even at the code level. The book is perfect for both junior and experienced learners. It’s written to be language-agnostic, with advice and vulnerability insights that will work with any stack.

You’ll begin with the foundations of web security and then dive into dozens of practical security recommendations for both common and not-so-common vulnerabilities—everything from SQL injection to cross-site scripting inclusion attacks. Explore growing modern threats like supply-chain attacks and attacks on APIs, learn about cryptography and how it applies to the web, and discover how to pick up the pieces after a hacker has successfully gotten inside your app.

About the reader

For junior web developers who know the basics of web programming, or more experienced developers looking for concrete advice on solving vulnerabilities.

About the author

Malcolm McDonald is the creator of hacksplaining.com, a comprehensive and interactive security training solution that helps working web developers brush up on their security knowledge. He is a security engineer with 20 years of experience across investment banking, start-ups, and PayPal. He has personally trained thousands of developers in web security over his career.