This is a review of The Tangled Web: A Guide to Securing Modern Web Applications.
This book does a great job explaining how the “bricks” of the Internet (HTTP, HTML, WWW, Cookies, Script Languages) are working (or not) from a security point of view. Also, a very systematic coverage of browser (in)security is given, even if some of the information is starting to become outdated. The book is aimed at web developers that are interested in the inner workings of browsers in order to write more secure code.
Chapter 1: Security in the World of Web Applications
The goal of this chapter is to set the scene for the rest of book. The main ideas revolve around the fact that security is a non-algorithmic problem and the best ways to tackle security problems are, therefore, very empirical (learn from mistakes, develop tools to detect and correct problems, and plan to have everything compromised).
Another part of the chapter is dedicated to the history of the web because, for the author, it is very important to understand the history behind the well known “bricks” of the Internet (HTTP, HTML, WWW) in order to understand why, from a security point of view, they are completely broken. For a long time, the standard evolution of the Internet was dominated by vendors or stakeholders who did not care much about the long-term prospects of technology; see the Wikipedia Browser Wars page for a few examples.
Part I: Anatomy of the Web (Chapters 2 to 8)
In this part of the book, the author speaks only briefly about security features, knowing that the second part of the book will be focused on security.
Part II: Browser Security Features (Chapters 9 to 15)
The first security feature presented is the SOP (Same Policy Origin), which is also the most important mechanism to protect against hostile applications. The SOP's behavior is described in relation to DOM documents, XMLHttpRequests, WebStorage, and how the security policies for cookies could impact the SOP.
The last part is about different mechanisms that browsers are using in order to give special privileges to some specific websites. The mechanisms the author explains are form-based password managers, hard-coded domain names, and the Internet Explorer Zone model.
Part III: Glimpse of Things to Come (Chapters 16 to 17)
This part is about the developments made in the industry to enhance the security of browsers.
For the author, there are two ways that browser security could evolve: extend the existing framework(s) or try to restrict the existing framework(s) by creating new boundaries on top of the existing browser security model.
For the first alternative, the following solutions are presented: the W3C Cross-Origin Resource Sharing specification, the Microsoft response to CORS called XDomainRequest (which, by the way, has since been deprecated by Microsoft), and W3C Uniform Messaging Policy.
For the second alternative, the following solutions are presented: W3C's (formerly Mozilla's) Content Security Policy, (WebKit) Sandboxed frames, and Strict Transport Security.
Chapter 18: Common Web Vulnerabilities
The last chapter is a nomenclature of different known vulnerabilities grouped by the place where it can happen (server side, client side). For each item, a brief definition is given and links are provided towards previous chapters where the item has been discussed.