The Tangled Web: A Guide to Securing Modern Web Applications

The Tangled Web: A Guide to Securing Modern Web Applications
By Michal Zalewski

List Price: $49.95
Price: $35.43 Details

Availability: Usually ships in 24 hours
Ships from and sold by Amazon.com

44 new or used available from $17.98

Average customer review:
(36 customer reviews)

Product Description

"Thorough and comprehensive coverage from one of the foremost experts in browser security."
--Tavis Ormandy, Google Inc.

Modern web applications are built on a tangle of technologies that have been developed over time and then haphazardly pieced together. Every piece of the web application stack, from HTTP requests to browser-side scripts, comes with important yet subtle security consequences. To keep users safe, it is essential for developers to confidently navigate this landscape.

In The Tangled Web, Michal Zalewski, one of the world's top browser security experts, offers a compelling narrative that explains exactly how browsers work and why they're fundamentally insecure. Rather than dispense simplistic advice on vulnerabilities, Zalewski examines the entire browser security model, revealing weak points and providing crucial information for shoring up web application security. You'll learn how to:
  • Perform common but surprisingly complex tasks such as URL parsing and HTML sanitization
  • Use modern security features like Strict Transport Security, Content Security Policy, and Cross-Origin Resource Sharing
  • Leverage many variants of the same-origin policy to safely compartmentalize complex web applications and protect user credentials in case of XSS bugs
  • Build mashups and embed gadgets without getting stung by the tricky frame navigation policy
  • Embed or host user-supplied content without running into the trap of content sniffing
For quick reference, "Security Engineering Cheat Sheets" at the end of each chapter offer ready solutions to problems you're most likely to encounter. With coverage extending as far as planned HTML5 features, The Tangled Web will help you create secure web applications that stand the test of time.


Product Details

  • Amazon Sales Rank: #96324 in Books
  • Published on: 2011-11-26
  • Original language: English
  • Number of items: 1
  • Dimensions: 9.25" h x .83" w x 7.00" l, 1.33 pounds
  • Binding: Paperback
  • 320 pages

Editorial Reviews

About the Author

Michal Zalewski is an internationally recognized information security expert with a long track record of delivering cutting-edge research. He is credited with discovering hundreds of notable security vulnerabilities and frequently appears on lists of the most influential security experts. He is the author of Silence on the Wire (No Starch Press), Google's "Browser Security Handbook," and numerous important research papers.


Customer Reviews

Most helpful customer reviews

0 of 0 people found the following review helpful.
4The pitfalls of web and browsers
By Hugo Assuncao
It's an impressive web and browser insideout.
This book is for you, if you want to learn the pitfalls.

6 of 7 people found the following review helpful.
5Systematic coverage of browser security
By Marcin Antkiewicz
The book provides systematic coverage of browser security. The first 6 pages of chapter 1 provide brilliant insight into why formal security models, risk management and taxonomies fail to deliver promised security improvements to organizations that embrace them. I used to explain the same with a lot of hand weaving, Zalewski's approach and insight are far superior.

Make no mistake, the book is focused on the browser and related technologies rather than the theory of security. The same tremendous insight, that made me nod with appreciation and wish that I had the book 5 years ago while working on security policies, illuminates browser concepts like in-browser content separation, scripting, and much more.

I appreciate the authors treatment of each of the concepts in the context of the browser as a complex and still evolving technology, with it's own history, standards, market requirements and politics.

0 of 0 people found the following review helpful.
4Great reference book
By Mathieu Baudet
Solid content to help one understand all the sad quirks of our Web standards! A great reference book for all security web engineers.

See all 36 customer reviews...

Connect with defaultLogic
What We've Done
Led Digital Marketing Efforts of Top 500 e-Retailers.
Worked with Top Brands at Leading Agencies.
Successfully Managed Over $50 million in Digital Ad Spend.
Developed Strategies and Processes that Enabled Brands to Grow During an Economic Downturn.
Taught Advanced Internet Marketing Strategies at the graduate level.



Warning: include(s2/ac/defaultlogic/modal.php): failed to open stream: No such file or directory in /home/adddocom/public_html/s2/lib/cm/dyn.php on line 33

Warning: include(s2/ac/defaultlogic/modal.php): failed to open stream: No such file or directory in /home/adddocom/public_html/s2/lib/cm/dyn.php on line 33

Warning: include(): Failed opening 's2/ac/defaultlogic/modal.php' for inclusion (include_path='.:/opt/alt/php55/usr/share/pear:/opt/alt/php55/usr/share/php') in /home/adddocom/public_html/s2/lib/cm/dyn.php on line 33

Manage research, learning and skills at defaultLogic. Create an account using LinkedIn or facebook to manage and organize your IT knowledge. defaultLogic works like a shopping cart for information -- helping you to save, discuss and share.


  Contact Us