Securing Ajax Applications. Ensuring the Safety of the Dynamic Web (ebook)(audiobook)(audiobook)

Kup polskie wydanie:

Spis treści

• Securing Ajax Applications
  • SPECIAL OFFER: Upgrade this ebook with OReilly
  • Preface
    • Audience
    • Assumptions This Book Makes
    • Contents of This Book
    • Conventions Used in This Book
    • Using Code Examples
    • How to Contact Us
    • Safari Enabled
    • Acknowledgments
  • 1. The Evolving Web
    • 1.1. The Rise of the Web
      • 1.1.1. Hypertext Transfer Protocol (HTTP)
      • 1.1.2. HTTP Transactions
      • 1.1.3. The response
      • 1.1.4. HTTP Methods
        • 1.1.4.1. Safe methods
        • 1.1.4.2. Idempotent methods
      • 1.1.5. HTTP Response
        • 1.1.5.1. HTTP status codes
        • 1.1.5.2. 2xx success codes
        • 1.1.5.3. 3xx redirection codes
        • 1.1.5.4. 4xx client error codes
        • 1.1.5.5. 5xx server error codes
      • 1.1.6. HTTP Headers
        • 1.1.6.1. General headers
        • 1.1.6.2. Request headers
        • 1.1.6.3. Response headers
        • 1.1.6.4. Entity headers
        • 1.1.6.5. Content headers
      • 1.1.7. Message or Entity Body
      • 1.1.8. HTML
      • 1.1.9. Mosaic and Netscape
      • 1.1.10. The Browser Wars
      • 1.1.11. Plug-ins, ActiveX, Applets, and JavaScript, Flash
        • 1.1.11.1. Java applets
        • 1.1.11.2. ActiveX
        • 1.1.11.3. Flash
      • 1.1.12. The Dot-Com Bubble
      • 1.1.13. Web Servers
        • 1.1.13.1. Netscape Enterprise Server
        • 1.1.13.2. Apache
        • 1.1.13.3. Microsofts Internet Information Server (IIS)
      • 1.1.14. e-commerce
        • 1.1.14.1. The web application
        • 1.1.14.2. Application servers
        • 1.1.14.3. Commercials for Internet companies
      • 1.1.15. Pop!
      • 1.1.16. The Hero, Ajax
        • 1.1.16.1. XMLHTTP
        • 1.1.16.2. XMLHttpRequest
        • 1.1.16.3. XMLHttpRequest life cycle
      • 1.1.17. What Is an API?
        • 1.1.17.1. Google maps the way
        • 1.1.17.2. Security problem
        • 1.1.17.3. Solution: The Google Maps API
      • 1.1.18. Why Worry?
        • 1.1.18.1. Recreational developers
        • 1.1.18.2. Rapid application development (RAD)
        • 1.1.18.3. Software development life cycle (SDLC)
        • 1.1.18.4. CCPD
      • 1.1.19. For More Information
  • 2. Web Security
    • 2.1. Security Basics
      • 2.1.1. Build Security In
        • 2.1.1.1. Expect the unexpected
        • 2.1.1.2. Subjects
        • 2.1.1.3. Objects
        • 2.1.1.4. Operations
        • 2.1.1.5. Surface area
        • 2.1.1.6. Confidentiality
        • 2.1.1.7. Privacy
        • 2.1.1.8. Encryption
        • 2.1.1.9. Integrity/validation
        • 2.1.1.10. Authentication
        • 2.1.1.11. Authorization and access control
        • 2.1.1.12. Separation of duties
        • 2.1.1.13. Nonrepudiation
        • 2.1.1.14. Availability
        • 2.1.1.15. Trust
    • 2.2. Risk Analysis
      • 2.2.1. Web Application Anatomy
        • 2.2.1.1. Entry points
        • 2.2.1.2. Trust level
        • 2.2.1.3. Assets
        • 2.2.1.4. Threats and attack path
        • 2.2.1.5. Think like an attacker
      • 2.2.2. Threat Profiling
    • 2.3. Common Web Application Vulnerabilities
      • 2.3.1. OWASP
        • 2.3.1.1. OWASP top 10
      • 2.3.2. Unvalidated Input
        • 2.3.2.1. Positive versus negative validation
        • 2.3.2.2. Client-side validation
        • 2.3.2.3. Fuzzing
      • 2.3.3. Broken Access Control
        • 2.3.3.1. Administration interfaces
      • 2.3.4. Broken Authentication and Session Management
        • 2.3.4.1. What is an authentication factor?
        • 2.3.4.2. Login credentials
        • 2.3.4.3. Administrative interfaces
        • 2.3.4.4. Session management
        • 2.3.4.5. Don't let an old caller back in
      • 2.3.5. Cross-Site Scripting (XSS)
      • 2.3.6. Buffer Overflow
        • 2.3.6.1. Buffer overflows in web applications
      • 2.3.7. Injection Flaws
      • 2.3.8. Improper Error Handling
      • 2.3.9. Insecure Storage
      • 2.3.10. Application Denial of Service
      • 2.3.11. Insecure Configuration Management
      • 2.3.12. Other Vulnerabilities
      • 2.3.13. For More Information
  • 3. Securing Web Technologies
    • 3.1. How Web Sites Communicate
      • 3.1.1. Client to Server Communications
      • 3.1.2. Server to Server Communications
        • 3.1.2.1. Screen scraping
      • 3.1.3. Domain to Domain (Cross-Domain) Communications
        • 3.1.3.1. XML
        • 3.1.3.2. JSON
        • 3.1.3.3. Web services
    • 3.2. Browser Security
      • 3.2.1. STRIDE
      • 3.2.2. Web Security Controls
        • 3.2.2.1. SSL/TLS transport encryption
        • 3.2.2.2. Encrypting data with symmetric encryption
        • 3.2.2.3. The browser's same-origin policy
      • 3.2.3. Client-Side Data and Managing State
        • 3.2.3.1. HTML input fields
        • 3.2.3.2. Cookies and HTTP headers
        • 3.2.3.3. URL rewriting
      • 3.2.4. Protecting Data in Transit
      • 3.2.5. Session Management
    • 3.3. Browser Plug-ins, Extensions, and Add-ons
      • 3.3.1. ActiveX
      • 3.3.2. Java Applets
      • 3.3.3. JavaScript
      • 3.3.4. XHTML/DOM Manipulation
      • 3.3.5. Flash
        • 3.3.5.1. Flex
        • 3.3.5.2. ActionScript
      • 3.3.6. HTML and CSS
      • 3.3.7. Ajax
        • 3.3.7.1. Authenticating users
        • 3.3.7.2. Preventing parameter tampering
        • 3.3.7.3. Protecting data in transit
        • 3.3.7.4. Preventing session hijacking
        • 3.3.7.5. Validating input
        • 3.3.7.6. Securing configurations
        • 3.3.7.7. Exception handling
        • 3.3.7.8. Auditing user activity
        • 3.3.7.9. Protecting data in storage
      • 3.3.8. For More Information
  • 4. Protecting the Server
    • 4.1. Network Security
      • 4.1.1. Firewalls
        • 4.1.1.1. Trust boundaries
        • 4.1.1.2. Security concerns
        • 4.1.1.3. Port 80
        • 4.1.1.4. SSL
        • 4.1.1.5. SSL proxies
        • 4.1.1.6. Network tiers and the DMZ
        • 4.1.1.7. Separation of duties
    • 4.2. Host Security
      • 4.2.1. Ubuntu
        • 4.2.1.1. Automatic LAMP
      • 4.2.2. OS Hardening
        • 4.2.2.1. Accounts management
        • 4.2.2.2. Running services
        • 4.2.2.3. SUID and SGID
      • 4.2.3. Logging and Auditing
        • 4.2.3.1. Unix/Linux
        • 4.2.3.2. Facilities and priorities
        • 4.2.3.3. Syslog configuration file (/etc/syslog.conf)
        • 4.2.3.4. Process accounting
        • 4.2.3.5. Windows
        • 4.2.3.6. A logging server
      • 4.2.4. Keeping Up to Date
        • 4.2.4.1. APT
        • 4.2.4.2. Windows update
      • 4.2.5. Host Firewall
        • 4.2.5.1. Using iptables
      • 4.2.6. Intrusion Detection
        • 4.2.6.1. Log examination
        • 4.2.6.2. File integrity checks
        • 4.2.6.3. Network monitoring
      • 4.2.7. Make a Copy
        • 4.2.7.1. Partimage
        • 4.2.7.2. dd_rescue
      • 4.2.8. Incident Response
        • 4.2.8.1. Have a plan (disaster recovery plan)
        • 4.2.8.2. HELP! I've been hacked!
    • 4.3. Web Server Hardening
      • 4.3.1. Apache HTTP Server
        • 4.3.1.1. Security concerns
      • 4.3.2. mod_security
        • 4.3.2.1. Installation
        • 4.3.2.2. Basic configuration
        • 4.3.2.3. Actions
        • 4.3.2.4. Filters
        • 4.3.2.5. Resources
      • 4.3.3. PHP
        • 4.3.3.1. Hardening guidelines
      • 4.3.4. Microsoft Internet Information Server (IIS)
        • 4.3.4.1. Lock down server
        • 4.3.4.2. Secure configurations for web servers
        • 4.3.4.3. Hardening guidelines
        • 4.3.4.4. Security concerns
    • 4.4. Application Server Hardening
      • 4.4.1. Java and .NET
        • 4.4.1.1. Hardening guidelines
      • 4.4.2. For More Information
  • 5. A Weak Foundation
    • 5.1. HTTP Vulnerabilities
      • 5.1.1. Input Validation
      • 5.1.2. Authentication and Session Management
        • 5.1.2.1. Authentication hijacking
        • 5.1.2.2. HTTP basic authentication
        • 5.1.2.3. Security and session IDs
      • 5.1.3. Authorization
    • 5.2. The Threats
      • 5.2.1. Cross-Site Scripting (XSS)
      • 5.2.2. Injection Vulnerabilities
        • 5.2.2.1. SQL injection
        • 5.2.2.2. Lightweight Directory Access Protocol (LDAP) injection
        • 5.2.2.3. Command or process injection
        • 5.2.2.4. HTTP response splitting
        • 5.2.2.5. DOM injection and JavaScript
        • 5.2.2.6. Cross-site Request Forgery (CSRF or XSRF)
        • 5.2.2.7. Cross-user defacement
        • 5.2.2.8. Cache poisoning
      • 5.2.3. Other Vulnerabilities
        • 5.2.3.1. Buffer overflows
        • 5.2.3.2. Insecure storage
        • 5.2.3.3. Application denial of service
      • 5.2.4. Data Handling
        • 5.2.4.1. Improper error handling
    • 5.3. JSON
      • 5.3.1.
        • 5.3.1.1. Validation and implementation
        • 5.3.1.2. Authentication and authorization
        • 5.3.1.3. Script/same origin policy
    • 5.4. XML
      • 5.4.1. Input Validation
      • 5.4.2. Authentication and Authorization
      • 5.4.3. Injection Flaws
      • 5.4.4. Insecure Storage
      • 5.4.5. XML Denial of Service (XDOS)
    • 5.5. RSS
      • 5.5.1.
        • 5.5.1.1. Consuming RSS
    • 5.6. Atom
      • 5.6.1.
        • 5.6.1.1. Atom compared to RSS
      • 5.6.2. Signing Content
    • 5.7. REST
      • 5.7.1.
        • 5.7.1.1. REST web services characteristics
        • 5.7.1.2. Principles of REST web service design
      • 5.7.2. For More Information
  • 6. Securing Web Services
    • 6.1. Web Services Overview
      • 6.1.1. Service Oriented Architecture (SOA)
      • 6.1.2. Ajax and Web Services
      • 6.1.3. Simple Object Access Protocol (SOAP)
        • 6.1.3.1. Anatomy of a SOAP message
        • 6.1.3.2. SOAP envelope
        • 6.1.3.3. SOAP headers
        • 6.1.3.4. SOAP body
        • 6.1.3.5. SOAP faults
      • 6.1.4. Universal Description Discovery and Integration (UDDI)
      • 6.1.5. Web Service Description Language (WSDL)
        • 6.1.5.1. Anatomy of a WSDL document
        • 6.1.5.2. Hooking up the Ajax
    • 6.2. Security and Web Services
      • 6.2.1. Identification
      • 6.2.2. Authentication
        • 6.2.2.1. Username and password
        • 6.2.2.2. X509 digital certificates
        • 6.2.2.3. Security Assertion Markup Language (SAML)
      • 6.2.3. Passing Credentials
      • 6.2.4. Authorization
        • 6.2.4.1. Least privilege/separation of duties
      • 6.2.5. Confidentiality and Transport Layer Security
      • 6.2.6. Information Leakage
      • 6.2.7. Data Integrity and Message-Level Security
        • 6.2.7.1. XML encryption
        • 6.2.7.2. XML digital signatures
        • 6.2.7.3. Message/security extensibility
      • 6.2.8. Auditing and Nonrepudiation
      • 6.2.9. Don't Forget It's the Web
    • 6.3. Web Service Security
      • 6.3.1.
        • 6.3.1.1. Secure header management
        • 6.3.1.2. Secure tokens and credentials
        • 6.3.1.3. Timestamping
      • 6.3.2. For More Information
  • 7. Building Secure APIs
    • 7.1. Building Your Own APIs
      • 7.1.1. API Construction
      • 7.1.2. API Design
        • 7.1.2.1. Design web APIs by contract
    • 7.2. Preconditions
    • 7.3. Postconditions
    • 7.4. Invariants
      • 7.4.1. Building a Good API
    • 7.5. Security Concerns
      • 7.5.1. Authentication
      • 7.5.2. Data Validation
      • 7.5.3. Content Validation and Authentication
      • 7.5.4. Availability
      • 7.5.5. Information Leakage
    • 7.6. RESTful Web Services
      • 7.6.1. Why Use REST?
      • 7.6.2. Who Is Using REST?
      • 7.6.3. How REST Web Services Work
        • 7.6.3.1. GET versus POST
        • 7.6.3.2. Communication choices
      • 7.6.4. REST Example
        • 7.6.4.1. Get word list
        • 7.6.4.2. Get word
        • 7.6.4.3. Rate a word
      • 7.6.5. For More Information
  • 8. Mashups
    • 8.1. Web Applications and Open Internet APIs
    • 8.2. Wild Web 2.0
    • 8.3. Mashups and Security
      • 8.3.1. Lack of Trust
      • 8.3.2. The Dark Side
    • 8.4. Open Versus Secure
      • 8.4.1. Lack of Security Standards
    • 8.5. A Security Blanket
      • 8.5.1. Confidentiality
      • 8.5.2. Integrity
      • 8.5.3. Availability
    • 8.6. Case Studies
      • 8.6.1. Pageflakes.com
        • 8.6.1.1. Company
        • 8.6.1.2. Location
        • 8.6.1.3. Authentication mechanisms
        • 8.6.1.4. The pulp
        • 8.6.1.5. Content representation
        • 8.6.1.6. User-specific data
        • 8.6.1.7. Additional services
        • 8.6.1.8. Security concerns
      • 8.6.2. Public911.com
        • 8.6.2.1. Company
        • 8.6.2.2. Location
        • 8.6.2.3. Authentication mechanisms
        • 8.6.2.4. The pulp
        • 8.6.2.5. Content representation
        • 8.6.2.6. User-specific data
        • 8.6.2.7. Additional services
        • 8.6.2.8. Security concerns
      • 8.6.3. WeatherBonk.com
        • 8.6.3.1. Company
        • 8.6.3.2. Location
        • 8.6.3.3. Authentication mechanisms
        • 8.6.3.4. The pulp
        • 8.6.3.5. Content representation
        • 8.6.3.6. User-specific data
        • 8.6.3.7. Additional services
        • 8.6.3.8. Security features
      • 8.6.4. HousingMaps.com
        • 8.6.4.1. Location
        • 8.6.4.2. Authentication mechanisms
        • 8.6.4.3. The pulp
        • 8.6.4.4. Content representation
        • 8.6.4.5. User-specific data
        • 8.6.4.6. Security concerns
      • 8.6.5. Conclusion
      • 8.6.6. For More Information
  • About the Author
  • Colophon
  • SPECIAL OFFER: Upgrade this ebook with OReilly

pokaż cały spis treści

ukryj recenzje