Y. E. Liang - JavaScript Security [2014, PDF, ENG] + Code torrent

Книги и журналы » Компьютерная литература » Веб-дизайн и программирование

JavaScript Security

Год: 2014
Автор: Y. E. Liang
Издательство: Packt Publishing
ISBN: 978-1-78398-801-3
Язык: Английский
Формат: PDF
Качество: Изначально компьютерное (eBook)
Количество страниц: 112
Описание:

This book starts off with an introduction to JavaScript security and gives you an overview of the basic functions JavaScript can perform on the Web, both on the client side and the server side. It demonstrates a couple of ways in which RESTful APIs can be laden with security flaws. You will also create a simple RESTful server using Express.js and Node.js. You will then focus on one of the most common JavaScript security attacks, cross-site scripting, and how to prevent cross-site scripting and cross-site forgery.

Last but not least, the book covers JavaScript phishing, how it works, and ways to counter it.

By the end of this book, you will be able to identify various risks of JavaScript and how to prevent them.
[spoiler="Примеры страниц"]

[/spoiler]
[spoiler="Оглавление"]
Preface
Chapter 1: JavaScript and the Web
JavaScript and your HTML/CSS elements
jQuery effects
Hide/Show
Toggle
Animation
Chaining
jQuery Ajax
jQuery GET
jQuery getJSON
jQuery POST
JavaScript beyond the client
JavaScript on the server side
Full-stack JavaScript
JavaScript security issues
Cross-site request forgery
Cross-site scripting
Chapter 2: Secure Ajax RESTful APIs
Building a RESTful server
A simple RESTful server in Node.js and Express.js
Frontend code for the to-do list app on top of Express.js
Cross-origin injection
Injecting JavaScript code
Guessing the API endpoints
Basic defense against similar attacks
Chapter 3: Cross-site Scripting
What is cross-site scripting?
Persistent cross-site scripting
Nonpersistent cross-site scripting
Examples of cross-site scripting
A simple to-do app using Tornado/Python
Coding up server.py
Cross-site scripting example 1
Cross-site scripting example 2
Cross-site scripting example 3
Defending against cross-site scripting
Do not trust users – parsing input by users
Chapter 4: Cross-site Request Forgery
Introducing cross-site request forgery
Examples of CSRF
Basic defense against CSRF attacks
Other examples of CSRF
CSRF using the tags
Other forms of protection
Creating your own app ID and app secret – OAuth-styled
Checking the Origin header
Limiting the lifetime of the token
Chapter 5: Misplaced Trust in the Client
When trust gets misplaced
A simple example
Building the server side – mistrust.py
The templates
To trust or not to trust
Manipulating the JavaScript code
Dealing with mistrust
Chapter 6: JavaScript Phishing
What is JavaScript phishing?
Examples of JavaScript phishing
Classic examples
Accessing user history by accessing the local state
XSS and CSRF
Intercepting events
Defending against JavaScript phishing
Upgrading to latest versions of web browsers
Recognizing real web pages
Protecting your site against XSS and CSRF
Avoid using pop ups and keep your address bars
Index
[/spoiler]