深度解析：Web应用安全的现代防护策略

3星 · 超过75%的资源需积分: 10 79 浏览量更新于2024-07-24 1 收藏 3.98MB PDF 举报

"《Web之困：现代Web应用安全指南》是一本深度探讨Web安全领域的权威之作，由业界领先的专家撰写。书中全面涵盖了Web安全的标准和技术挑战，旨在帮助读者理解和应对现代Web应用所面临的复杂安全环境。书中不仅介绍了最新的安全标准，如OWASP Top 10（十大常见Web应用程序攻击）和HTTPS等，还深入剖析了浏览器安全、隐私保护、网络通信安全等问题。作者以详实的案例和丰富的实践经验，为开发者、安全专业人员以及对在线安全有所关注的个人提供了宝贵的指导。书中强调了实践中的安全措施和最佳实践，如输入验证、身份认证、数据加密、漏洞管理等，使读者能够提升Web应用的安全性和防护能力。书评中，Tavis Ormandy、Collin Jackson、Mark Dowd、Michal Zalewski等业内专家纷纷给予高度评价，认为该书是了解和确保Web技术安全的必备参考。他们赞扬了书中的创新性思维、深度洞察以及对复杂技术问题的清晰解释，让读者在阅读后能有全新的视角看待Web安全。例如，Tavis Ormandy提到该书具有“全面而深入的覆盖”，表明它不仅适合初级学习者，也适合经验丰富的专业人士进行深度研究。同时，书中的详细程度和实际示例被Linux User & Developer杂志称赞为“惊人”，证明其在传授知识上的高效性。《Web之困：现代Web应用安全指南》不仅是对当前Web安全状态的一次全面审视，更是提升Web开发和安全实践的一把钥匙。对于任何希望在网络上保护自己和用户安全的人来说，这是一本不容错过的必读书籍。"

xiv Contents in Detail

Cross-Domain Content Inclusion .............................................................................. 181

A Note on Cross-Origin Subresources......................................................... 183

Privacy-Related Side Channels ................................................................................ 184

Other SOP Loopholes and Their Uses ...................................................................... 185

Security Engineering Cheat Sheet............................................................................ 186

Good Security Hygiene for All Websites ..................................................... 186

When Including Cross-Domain Resources .................................................... 186

When Arranging Cross-Domain Communications in JavaScript ...................... 186

OTHER SECURITY BOUNDARIES 187

Navigation to Sensitive Schemes............................................................................. 188

Access to Internal Networks.................................................................................... 189

Prohibited Ports..................................................................................................... 190

Limitations on Third-Party Cookies............................................................................ 192

Security Engineering Cheat Sheet............................................................................ 195

When Building Web Applications on Internal Networks................................ 195

When Launching Non-HTTP Services, Particularly on Nonstandard Ports ......... 195

When Using Third-Party Cookies for Gadgets or Sandboxed Content ............. 195

CONTENT RECOGNITION MECHANISMS 197

Document Type Detection Logic............................................................................... 198

Malformed MIME Types............................................................................ 199

Special Content-Type Values...................................................................... 200

Unrecognized Content Type ...................................................................... 202

Defensive Uses of Content-Disposition ......................................................... 203

Content Directives on Subresources ............................................................ 204

Downloaded Files and Other Non-HTTP Content ......................................... 205

Character Set Handling ......................................................................................... 206

Byte Order Marks .................................................................................... 208

Character Set Inheritance and Override ...................................................... 209

Markup-Controlled Charset on Subresources................................................ 209

Detection for Non-HTTP Files...................................................................... 210

Security Engineering Cheat Sheet............................................................................ 212

Good Security Practices for All Websites..................................................... 212

When Generating Documents with Partly Attacker-Controlled Contents ........... 212

When Hosting User-Generated Files ........................................................... 212

DEALING WITH ROGUE SCRIPTS 213

Denial-of-Service Attacks ........................................................................................ 214

Execution Time and Memory Use Restrictions............................................... 215

Connection Limits ..................................................................................... 216

Pop-Up Filtering ....................................................................................... 217

Dialog Use Restrictions.............................................................................. 218

Window-Positioning and Appearance Problems ........................................................ 219

Timing Attacks on User Interfaces ............................................................................ 222

Contents in Detail xv

Security Engineering Cheat Sheet............................................................................ 224

When Permitting User-Created <iframe> Gadgets on Your Site...................... 224

When Building Security-Sensitive UIs .......................................................... 224

EXTRINSIC SITE PRIVILEGES 225

Browser- and Plug-in-Managed Site Permissions ........................................................ 226

Hardcoded Domains ................................................................................ 227

Form-Based Password Managers............................................................................. 227

Internet Explorer’s Zone Model ............................................................................... 229

Mark of the Web and Zone.Identifier ......................................................... 231

Security Engineering Cheat Sheet............................................................................ 232

When Requesting Elevated Permissions from Within a Web Application ......... 232

When Writing Plug-ins or Extensions That Recognize Privileged Origins.......... 232

PART III: A GLIMPSE OF THINGS TO COME 233

NEW AND UPCOMING SECURITY FEATURES 235

Security Model Extension Frameworks ..................................................................... 236

Cross-Domain Requests ............................................................................. 236

XDomainRequest ...................................................................................... 239

Other Uses of the Origin Header ............................................................... 240

Security Model Restriction Frameworks .................................................................... 241

Content Security Policy.............................................................................. 242

Sandboxed Frames .................................................................................. 245

Strict Transport Security............................................................................. 248

Private Browsing Modes............................................................................ 249

Other Developments .............................................................................................. 250

In-Browser HTML Sanitizers........................................................................ 250

XSS Filtering ............................................................................................ 251

Security Engineering Cheat Sheet............................................................................ 253

OTHER BROWSER MECHANISMS OF NOTE 255

URL- and Protocol-Level Proposals ............................................................................ 256

Content-Level Features............................................................................................ 258

I/O Interfaces....................................................................................................... 259

COMMON WEB VULNERABILITIES 261

Vulnerabilities Specific to Web Applications............................................................. 262

Problems to Keep in Mind in Web Application Design............................................... 263

Common Problems Unique to Server-Side Code ........................................................ 265

xviii Preface

and implementation shortcomings of the World Wide Web are those of a

technology that never aspired to its current status and never had a chance

to pause and look back at previous mistakes. The resulting issues have quickly

emerged as some of the most significant and prevalent threats to data secu-

rity today: As it turns out, the protocol design standards one would apply to

a black-on-gray home page full of dancing hamsters are not necessarily the

same for an online shop that processes millions of credit card transactions

every year.

When taking a look at the past decade, it is difficult not to be slightly

disappointed: Nearly every single noteworthy online application devised so

far has had to pay a price for the corners cut in the early days of the Web.

Heck, xssed.com, a site dedicated to tracking a narrow subset of web-related

security glitches, amassed some 50,000 entries in about three years of opera-

tion. Yet, browser vendors are largely unfazed, and the security community

itself has offered little insight or advice on how to cope with the widespread

misery. Instead, many security experts stick to building byzantine vulnerabil-

ity taxonomies and engage in habitual but vague hand wringing about the

supposed causes of this mess.

Part of the problem is that said experts have long been dismissive of the

whole web security ruckus, unable to understand what it was all about. They

have been quick to label web security flaws as trivial manifestations of the

confused deputy problem

or of some other catchy label outlined in a trade jour-

nal three decades ago. And why should they care about web security, anyway?

What is the impact of an obscene comment injected onto a dull pet-themed

home page compared to the gravity of a traditional system-compromise flaw?

In retrospect, I’m pretty sure most of us are biting our tongues. Not only

has the Web turned out to matter a lot more than originally expected, but

we’ve failed to pay attention to some fundamental characteristics that put

it well outside our comfort zone. After all, even the best-designed and most

thoroughly audited web applications have far more issues, far more frequently,

than their nonweb counterparts.

We all messed up, and it is time to repent. In the interest of repentance,

The Tangled Web tries to take a small step toward much-needed normalcy, and

as such, it may be the first publication to provide a systematic and thorough

analysis of the current state of affairs in the world of web application security.

In the process of doing so, it aims to shed light on the uniqueness of the secu-

rity challenges that we—security engineers, web developers, and users—have

to face every day.

The layout of this book is centered on exploring some of the most prom-

inent, high-level browser building blocks and various security-relevant topics

derived from this narrative. I have taken this approach because it seems to be

more informative and intuitive than simply enumerating the issues using an

Confused deputy problem is a generic concept in information security used to refer to a broad

class of design or implementation flaws. The term describes any vector that allows the attacker

to trick a program into misusing some “authority” (access privileges) to manipulate a resource

in an unintended manner—presumably one that is beneficial to the attacker, however that

benefit is defined. The phrase “confused deputy” is regularly invoked by security researchers

in academia, but since virtually all real-world security problems could be placed in this bucket

when considered at some level of abstraction, this term is nearly meaningless.

剩余323页未读，继续阅读

jimmyleeee

粉丝: 9485
资源: 10

深度解析：Web应用安全的现代防护策略

web之困：现代Web应用安全指南.pdf

Web之困：现代Web应用安全指南（中文版完整）

WEB之困：现代WEB应用安全指南

WEB之困-现代WEB应用安全指南

WEB之困 现代WEB应用安全指南

WEB之困 现代WEB应用安全指南.pdf

WEB之困现代WEB应用安全指南（不完整）.pdf

HTML5移动Web开发实战指南：构建现代Web应用

AngularJS权威指南：构建现代Web应用

AngularJS权威指南：打造现代Web应用

最新资源

WEB之困现代WEB应用安全指南

WEB之困现代WEB应用安全指南.pdf