Grokking Web Application Security

Putting an application on the web means exposing it to attackers from all over the world. Teaching yourself how to defend it from scattered online sources is a hit-and-miss affair, and some of the advice you find can leave your app weaker than before. Grokking Web Application Security by Malcolm McDonald is an illustrated, single-volume guide for working programmers who want a clear and complete picture of the attacks their applications will face.

The book starts with browser security: sandboxing, the same-origin policy and cookie security. It then turns to protecting web servers through input validation, output escaping and defense in depth, and describes a development process designed to keep security bugs out in the first place. Its catalogue of vulnerabilities is organized by where they occur. Browser problems include cross-site scripting, cross-site request forgery and clickjacking. Network problems include man-in-the-middle attacks, SSL-stripping and DNS poisoning. Authentication problems cover brute-forcing of credentials, along with single sign-on and multi-factor authentication. Authorization problems include broken access control and session jacking. Further chapters cover the use of encryption in web applications, injection, command execution and remote code execution attacks, and malicious payloads aimed at XML parsers and file upload functions.

McDonald gives practical recommendations for both common and unusual weaknesses, from SQL injection to cross-site scripting inclusion attacks. Readers learn what motivates hackers, which current tools help find problems, and how to build a development lifecycle that catches them early. The book can be read straight through as an overview of web security or used as a reference when a particular vulnerability needs attention.

The techniques apply to any technology stack, on both the frontend and the server side, and are illustrated with examples drawn from the author's long career. The book also looks at the tools and methods attackers use to break into systems. Topics include a security-first development process, encryption, supply-chain and API attacks, and what to do once a hacker has gotten in. It assumes the reader already understands the basics of web application design and technologies.