The Tangled Web: A Guide to Securing Modern Web Applications


"Thorough and comprehensive coverage from one of the foremost experts in browser security."

—Tavis Ormandy, Google Inc.

Modern web applications are built on a tangle of technologies that have been developed over time and then haphazardly pieced together. Every piece of the web application stack, from HTTP requests to browser-side scripts, comes with important yet subtle security consequences. To keep users safe, it is essential for developers to confidently navigate this ...

See more details below
$35.59 price
(Save 28%)$49.95 List Price

Pick Up In Store

Reserve and pick up in 60 minutes at your local store

Other sellers (Paperback)
  • All (19) from $23.49   
  • New (14) from $25.63   
  • Used (5) from $23.49   
Tangled Web: A Guide to Securing Modern Web Applications

Available on NOOK devices and apps  
  • NOOK Devices
  • Samsung Galaxy Tab 4 NOOK 7.0
  • Samsung Galaxy Tab 4 NOOK 10.1
  • NOOK HD Tablet
  • NOOK HD+ Tablet
  • NOOK eReaders
  • NOOK Color
  • NOOK Tablet
  • Tablet/Phone
  • NOOK for Windows 8 Tablet
  • NOOK for iOS
  • NOOK for Android
  • NOOK Kids for iPad
  • PC/Mac
  • NOOK for Windows 8
  • NOOK for PC
  • NOOK for Mac

Want a NOOK? Explore Now

NOOK Book (eBook)
$22.99 price
(Save 42%)$39.95 List Price


"Thorough and comprehensive coverage from one of the foremost experts in browser security."

—Tavis Ormandy, Google Inc.

Modern web applications are built on a tangle of technologies that have been developed over time and then haphazardly pieced together. Every piece of the web application stack, from HTTP requests to browser-side scripts, comes with important yet subtle security consequences. To keep users safe, it is essential for developers to confidently navigate this landscape.

In The Tangled Web, Michal Zalewski, one of the world's top browser security experts, offers a compelling narrative that explains exactly how browsers work and why they're fundamentally insecure. Rather than dispense simplistic advice on vulnerabilities, Zalewski examines the entire browser security model, revealing weak points and providing crucial information for shoring up web application security. You'll learn how to:

  • Perform common but surprisingly complex tasks such as URL parsing and HTML sanitization
  • Use modern security features like Strict Transport Security, Content Security Policy, and Cross-Origin Resource Sharing
  • Leverage many variants of the same-origin policy to safely compartmentalize complex web applications and protect user credentials in case of XSS bugs
  • Build mashups and embed gadgets without getting stung by the tricky frame navigation policy
  • Embed or host user-supplied content without running into the trap of content sniffing

For quick reference, "Security Engineering Cheat Sheets" at the end of each chapter offer ready solutions to problems you're most likely to encounter. With coverage extending as far as planned HTML5 features, The Tangled Web will help you create secure web applications that stand the test of time.

Read More Show Less

Product Details

  • ISBN-13: 9781593273880
  • Publisher: No Starch Press San Francisco, CA
  • Publication date: 11/26/2011
  • Edition number: 1
  • Pages: 320
  • Sales rank: 620,939
  • Product dimensions: 6.90 (w) x 9.20 (h) x 0.80 (d)

Meet the Author

Michal Zalewski is an internationally recognized information security expert with a long track record of delivering cutting-edge research. He is credited with discovering hundreds of notable security vulnerabilities and frequently appears on lists of the most influential security experts. He is the author of Silence on the Wire (No Starch Press), Google's "Browser Security Handbook," and numerous important research papers.

Read More Show Less

Table of Contents

Chapter 1: Security in the World of Web Applications;
1.1 Information Security in a Nutshell;
1.2 A Brief History of the Web;
1.3 The Evolution of a Threat;
1.4 Global browser market share, May 2011;
Anatomy of the Web;
Chapter 2: It Starts with a URL;
2.1 Uniform Resource Locator Structure;
2.2 Reserved Characters and Percent Encoding;
2.3 Common URL Schemes and Their Function;
2.4 Resolution of Relative URLs;
Chapter 3: Hypertext Transfer Protocol;
3.1 Basic Syntax of HTTP Traffic;
3.2 HTTP Request Types;
3.3 Server Response Codes;
3.4 Keepalive Sessions;
3.5 Chunked Data Transfers;
3.6 Caching Behavior;
3.7 HTTP Cookie Semantics;
3.8 HTTP Authentication;
3.9 Protocol-Level Encryption and Client Certificates;
Chapter 4: Hypertext Markup Language;
4.1 Basic Concepts Behind HTML Documents;
4.2 Understanding HTML Parser Behavior;
4.3 Entity Encoding;
4.4 HTTP/HTML Integration Semantics;
4.5 Hyperlinking and Content Inclusion;
Chapter 5: Cascading Style Sheets;
5.1 Basic CSS Syntax;
5.2 Parser Resynchronization Risks;
5.3 Character Encoding;
Chapter 6: Browser-Side Scripts;
6.1 Basic Characteristics of JavaScript;
6.2 Standard Object Hierarchy;
6.3 Script Character Encoding;
6.4 Code Inclusion Modes and Nesting Risks;
6.5 The Living Dead: Visual Basic;
Chapter 7: Non-HTML Document Types;
7.1 Plaintext Files;
7.2 Bitmap Images;
7.3 Audio and Video;
7.4 XML-Based Documents;
7.5 A Note on Nonrenderable File Types;
Chapter 8: Content Rendering with Browser Plug-ins;
8.1 Invoking a Plug-in;
8.2 Document Rendering Helpers;
8.3 Plug-in-Based Application Frameworks;
8.4 ActiveX Controls;
8.5 Living with Other Plug-ins;
Browser Security Features;
Chapter 9: Content Isolation Logic;
9.1 Same-Origin Policy for the Document Object Model;
9.2 Same-Origin Policy for XMLHttpRequest;
9.3 Same-Origin Policy for Web Storage;
9.4 Security Policy for Cookies;
9.5 Plug-in Security Rules;
9.6 Coping with Ambiguous or Unexpected Origins;
9.7 Other Uses of Origins;
Chapter 10: Origin Inheritance;
10.1 Origin Inheritance for about:blank;
10.2 Inheritance for data: URLs;
10.3 Inheritance for javascript: and vbscript: URLs;
10.4 A Note on Restricted Pseudo-URLs;
Chapter 11: Life Outside Same-Origin Rules;
11.1 Window and Frame Interactions;
11.2 Cross-Domain Content Inclusion;
11.3 Privacy-Related Side Channels;
11.4 Other SOP Loopholes and Their Uses;
Chapter 12: Other Security Boundaries;
12.1 Navigation to Sensitive Schemes;
12.2 Access to Internal Networks;
12.3 Prohibited Ports;
12.4 Limitations on Third-Party Cookies;
Chapter 13: Content Recognition Mechanisms;
13.1 Document Type Detection Logic;
13.2 Character Set Handling;
Chapter 14: Dealing with Rogue Scripts;
14.1 Denial-of-Service Attacks;
14.2 Window-Positioning and Appearance Problems;
14.3 Timing Attacks on User Interfaces;
Chapter 15: Extrinsic Site Privileges;
15.1 Browser- and Plug-in-Managed Site Permissions;
15.2 Form-Based Password Managers;
15.3 Internet Explorer’s Zone Model;
A Glimpse of Things to Come;
Chapter 16: New and Upcoming Security Features;
16.1 Security Model Extension Frameworks;
16.2 Security Model Restriction Frameworks;
16.3 Other Developments;
Chapter 17: Other Browser Mechanisms of Note;
17.1 URL- and Protocol-Level Proposals;
17.2 Content-Level Features;
17.3 I/O Interfaces;
Chapter 18: Common Web Vulnerabilities;
18.1 Vulnerabilities Specific to Web Applications;
18.2 Problems to Keep in Mind in Web Application Design;
18.3 Common Problems Unique to Server-Side Code;

Read More Show Less

Customer Reviews

Be the first to write a review
( 0 )
Rating Distribution

5 Star


4 Star


3 Star


2 Star


1 Star


Your Rating:

Your Name: Create a Pen Name or

Barnes & Review Rules

Our reader reviews allow you to share your comments on titles you liked, or didn't, with others. By submitting an online review, you are representing to Barnes & that all information contained in your review is original and accurate in all respects, and that the submission of such content by you and the posting of such content by Barnes & does not and will not violate the rights of any third party. Please follow the rules below to help ensure that your review can be posted.

Reviews by Our Customers Under the Age of 13

We highly value and respect everyone's opinion concerning the titles we offer. However, we cannot allow persons under the age of 13 to have accounts at or to post customer reviews. Please see our Terms of Use for more details.

What to exclude from your review:

Please do not write about reviews, commentary, or information posted on the product page. If you see any errors in the information on the product page, please send us an email.

Reviews should not contain any of the following:

  • - HTML tags, profanity, obscenities, vulgarities, or comments that defame anyone
  • - Time-sensitive information such as tour dates, signings, lectures, etc.
  • - Single-word reviews. Other people will read your review to discover why you liked or didn't like the title. Be descriptive.
  • - Comments focusing on the author or that may ruin the ending for others
  • - Phone numbers, addresses, URLs
  • - Pricing and availability information or alternative ordering information
  • - Advertisements or commercial solicitation


  • - By submitting a review, you grant to Barnes & and its sublicensees the royalty-free, perpetual, irrevocable right and license to use the review in accordance with the Barnes & Terms of Use.
  • - Barnes & reserves the right not to post any review -- particularly those that do not follow the terms and conditions of these Rules. Barnes & also reserves the right to remove any review at any time without notice.
  • - See Terms of Use for other conditions and disclaimers.
Search for Products You'd Like to Recommend

Recommend other products that relate to your review. Just search for them below and share!

Create a Pen Name

Your Pen Name is your unique identity on It will appear on the reviews you write and other website activities. Your Pen Name cannot be edited, changed or deleted once submitted.

Your Pen Name can be any combination of alphanumeric characters (plus - and _), and must be at least two characters long.

Continue Anonymously

    If you find inappropriate content, please report it to Barnes & Noble
    Why is this product inappropriate?
    Comments (optional)