The Tangled Web: A Guide to Securing Modern Web Applications 1st Edition

by Michal Zalewski (Author)

35 customer reviews

ISBN-13: 978-1593273880

ISBN-10: 1593273886

Why is ISBN important?

Have one to sell? Sell on Amazon

Added to

Unable to add item to List. Please try again.

Share <Embed>

Buy new

$58.31

In Stock.

Ships from and sold by californiabooks.

This item ships to France.

Price: $64.00
You Save: $5.69 (9%) Discount Provided by Amazon. Details

27 New from $50.27

Select delivery location

$58.31 + $35.00 shipping

Turn on 1-Click ordering

More Buying Choices

27 New from $50.27 40 Used from $19.91

67 used & new from $19.91

See All Buying Options

Free%20Two-Day%20Shipping%20for%20College%20Students%20with%20Amazon%20Student

"Thorough and comprehensive coverage from one of the foremost experts in browser security."
--Tavis Ormandy, Google Inc.

Modern web applications are built on a tangle of technologies that have been developed over time and then haphazardly pieced together. Every piece of the web application stack, from HTTP requests to browser-side scripts, comes with important yet subtle security consequences. To keep users safe, it is essential for developers to confidently navigate this landscape.

In The Tangled Web, Michal Zalewski, one of the world's top browser security experts, offers a compelling narrative that explains exactly how browsers work and why they're fundamentally insecure. Rather than dispense simplistic advice on vulnerabilities, Zalewski examines the entire browser security model, revealing weak points and providing crucial information for shoring up web application security. You'll learn how to:

Perform common but surprisingly complex tasks such as URL parsing and HTML sanitization
Use modern security features like Strict Transport Security, Content Security Policy, and Cross-Origin Resource Sharing
Leverage many variants of the same-origin policy to safely compartmentalize complex web applications and protect user credentials in case of XSS bugs
Build mashups and embed gadgets without getting stung by the tricky frame navigation policy
Embed or host user-supplied content without running into the trap of content sniffing

For quick reference, "Security Engineering Cheat Sheets" at the end of each chapter offer ready solutions to problems you're most likely to encounter. With coverage extending as far as planned HTML5 features, The Tangled Web will help you create secure web applications that stand the test of time.

Frequently bought together

Total price: $104.51

These items are shipped from and sold by different sellers. Show details

Buy the selected items together

This item:The Tangled Web: A Guide to Securing Modern Web Applications by Michal Zalewski Paperback $58.31
In Stock.
Ships from and sold by californiabooks.
The Web Application Hacker's Handbook: Finding and Exploiting Security Flaws by Dafydd Stuttard Paperback $37.20
In Stock.
Ships from and sold by Amazon.com.
FREE Shipping. Details
Rtfm: Red Team Field Manual by Ben Clark Paperback $9.00
In Stock.
Ships from and sold by Amazon.com.
FREE Shipping on orders over $25. Details

Customers who bought this item also bought

Page 1 of 1 Start overPage 1 of 1

This shopping feature will continue to load items. In order to navigate out of this carousel please use your heading shortcut key to navigate to the next or previous heading.

Dafydd Stuttard

73

Paperback
$37.20
Michal Zalewski

34

Paperback
59 offers from $13.21
Peter Kim

32

in Computer Network Security
Paperback
$26.87
Mark Dowd

29

Paperback
$75.99
Chris Anley

49

Paperback
$31.58
Ben Clark

462

Paperback
$9.00

Editorial Reviews

About the Author

Michal Zalewski is an internationally recognized information security expert with a long track record of delivering cutting-edge research. He is credited with discovering hundreds of notable security vulnerabilities and frequently appears on lists of the most influential security experts. He is the author of Silence on the Wire (No Starch Press), Google's "Browser Security Handbook," and numerous important research papers.

Paperback: 320 pages
Publisher: No Starch Press; 1 edition (November 29, 2011)
Language: English
ISBN-10: 1593273886
ISBN-13: 978-1593273880
Product Dimensions: 7 x 0.8 x 9 inches
Shipping Weight: 1.4 pounds (View shipping rates and policies)
Average Customer Review: 35 customer reviews
Amazon Best Sellers Rank: #230,707 in Books (See Top 100 in Books)
- #24 in Books > Computers & Technology > Internet & Social Media > Web Browsers
- #51 in Books > Computers & Technology > Security & Encryption > Viruses
- #82 in Books > Computers & Technology > Security & Encryption > Encryption

Would you like to tell us about a lower price?
If you are a seller for this product, would you like to suggest updates through seller support?

NO_CONTENT_IN_FEATURE

Be the first video

Your name here

Important information

Ingredients

Example Ingredients

Directions

Example Directions

Customer Reviews

Write a customer review

See all 35 customer reviews

Read reviews that mention

Top customer reviews

There was a problem filtering reviews right now. Please try again later.

Ilya Grigorik

Mandatory reading for every web developer

June 9, 2012

Format: PaperbackVerified Purchase

"Gaining insights into the underlying mechanics of web applications is far more important that memorizing several thousand random and often unnecessary terms."

That one sentence sums up why "The Tangled Web" is, hands down, the best book on web and browser security. It is all too easy to criticize, lament, and create paranoid scenarios about the "unsound security foundations" of the web. Truth is, all of that criticism is true, and yet the web has proven to be an incredibly robust platform. In this book Michal Zalewski walks us through the history and the evolution of the architecture of the popular browsers, servers, protocols, and everything in between - as it relates security of modern web applications.

Instead of focusing on the usual security acronyms and "attack classes", this book will give you something much more powerful: a bottom up understanding of how a modern browser operates, why it does what it does, and what implications this has for designing more secure applications. This book should be mandatory reading for every web-developer. Highly recommend it.

One person found this helpful

Helpful

Not Helpful

Comment

mtndwaddict

Tangled Web is a Tangled Mess

April 30, 2017

Format: PaperbackVerified Purchase

I'm about 25% through the book and it's a struggle. The book feels very thin in areas and all over the place. Like the Tangled web this book itself is a Tangled mess. It feels like I'm reading an encyclopedia, but without the depth or organization. At other times it feels like an extended dictionary. It's not a very long book either. It's more of a reference book. I'm not sure how this book is highly rated but definitely not a good read in my opinion and if I could, I would get my money back.

2 people found this helpful

Helpful

Not Helpful

Comment

Hugo Assuncao

The pitfalls of web and browsers

September 4, 2017

Format: Kindle EditionVerified Purchase

It's an impressive web and browser insideout.
This book is for you, if you want to learn the pitfalls.

Helpful

Not Helpful

Comment

Marcin Antkiewicz

Systematic coverage of browser security

November 30, 2011

Format: PaperbackVerified Purchase

The book provides systematic coverage of browser security. The first 6 pages of chapter 1 provide brilliant insight into why formal security models, risk management and taxonomies fail to deliver promised security improvements to organizations that embrace them. I used to explain the same with a lot of hand weaving, Zalewski's approach and insight are far superior.

Make no mistake, the book is focused on the browser and related technologies rather than the theory of security. The same tremendous insight, that made me nod with appreciation and wish that I had the book 5 years ago while working on security policies, illuminates browser concepts like in-browser content separation, scripting, and much more.

I appreciate the authors treatment of each of the concepts in the context of the browser as a complex and still evolving technology, with it's own history, standards, market requirements and politics.

6 people found this helpful

Comment

February 21, 2013

Format: PaperbackVerified Purchase

Solid content to help one understand all the sad quirks of our Web standards! A great reference book for all security web engineers.

Helpful

Not Helpful

Comment

rpm507

Good guidance for developing secure web applications

July 4, 2014

Format: Kindle EditionVerified Purchase

Did you know that every web application should have a crossdomain.xml? Check the top level of most popular sites. That is just one of the tips available in the Security Engineering Cheat Sheets in this book. Some of the content is a little dated but the guidance is very applicable.

Helpful

Not Helpful

Comment

Henrique Ferraz Arcoverde

At first i was conservative about this book because of ...

December 13, 2014

Format: PaperbackVerified Purchase

At first i was conservative about this book because of the topics, URL, HTML, etc... However, since i'm a Zalewski's fan, i decided to try it. When i read the first chapter, i got my mind blown. So many details where in front of me and i didn't realize until now. It's certainly a book for application security professionals, not for beginners.

One person found this helpful

Helpful

Not Helpful

Comment

Maxim Kachurovskiy

Best applied tech book I've ever read

April 11, 2013

Format: PaperbackVerified Purchase

This book is AWESOME. One should not be allowed to work on sensitive product without studying it.

Before I didn't even realized that e.g. when Flash makes cross domain requests it appends all ambient credentials - and there are so many insights like this in this book.

While reading I also found a bunch of critical vulnerabilities in the projects I know.

Helpful

Not Helpful

Comment

Most recent customer reviews

Pen Name

I don't understand what the hype around this book is about

I am a software engineer currently working on several web app projects. I have a moderate background in web app security and I bought this book in order to gain better insight on...Read more

Published 1 year ago

Ammy_Evaluator

Here be dragons!

This book has two major strikes against it. First is that its tone is very condescending - whether ripping into browser developers or specification writers, everyone gets to feel...Read more

Published 1 year ago

John

Five Stars

One of the most well written security books on any subject matter.

Published on May 1, 2015

Gunnar Wolf

Weak...

Really expected more from this book. It does have some interesting bits, but it lacks depth, does not manage to pull my attention.Read more

Published on December 10, 2014

Nyck

Highly-Effective Guide

A remarkable tour through the mess of protocols and band-aids that comprise the web we know and love today.Read more

Published on October 2, 2014

Ronald Ploeger

Not a developers book

Although not a bad book as such I found it to be annoying. Thats because the subtitle "A guide to securing modern web applications" lies. It is not a book for developers.Read more

Published on September 29, 2013

E. Gutesman

Zalewski again, driving the security practices

The book is very well written and goes through modern web application vulnerabilities. The author, as always, gives examples and very clear explanations.

Published on August 23, 2013

Lee Stecklov

rambling

The content is good but the organization of the book is somewhat rambling, jumping around. This is a problem which often appears in technical publications.

Published on July 7, 2013

Gunter von gingerbut

Explains how and why the web is broken

A great book. Initial focus on fundamentals of how url's etc work. Describes how browsers actually work moving into JavaScript and DOM etc.Read more

Published on May 18, 2013

Customers who viewed this item also viewed

Page 1 of 1 Start overPage 1 of 1

This shopping feature will continue to load items. In order to navigate out of this carousel please use your heading shortcut key to navigate to the next or previous heading.

Dafydd Stuttard

73

Paperback
$37.20
Michal Zalewski

34

Paperback
59 offers from $13.21
Bryan Sullivan

25

Paperback
$30.87
Peter Kim

32

in Computer Network Security
Paperback
$26.87
Mark Dowd

29

Paperback
$75.99
James Forshaw

5

Paperback
$41.99

Pages with related products. See and discover other items: web application development, web application security, enterprise security, network programming, application development, applications development