Securing Ajax Applications: Ensuring the Safety of the Dynamic Web by Christopher Wells

Product Description

Ajax applications should be open yet secure. Far too often security is added as an afterthought. Potential flaws need to be identified and addressed right away. This book explores Ajax and web application security with an eye for dangerous gaps and offers ways that you can plug them before they become a problem. By making security part of the process from the start, you will learn how to build secure Ajax applications and discover how to respond quickly when attacks occur.

Securing Ajax Applications succinctly explains that the same back-and-forth communications that make Ajax so responsive also gives invaders new opportunities to gather data, make creative new requests of your server, and interfere with the communications between you and your customers. This book presents basic security techniques and examines vulnerabilities with JavaScript, XML, JSON, Flash, and other technologies -- vital information that will ultimately save you time and money.

Topics include:

* An overview of the evolving web platform, including APIs, feeds, web services and asynchronous messaging
* Web security basics, including common vulnerabilities, common cures, state management and session management
* How to secure web technologies, such as Ajax, JavaScript, Java applets, Active X controls, plug-ins, Flash and Flex
* How to protect your server, including front-line defense, dealing with application servers, PHP and scripting
* Vulnerabilities among web standards such as HTTP, XML, JSON, RSS, ATOM, REST, and XDOS
* How to secure web services, build secure APIs, and make open mashups secure

Securing Ajax Applications takes on the challenges created by this new generation of web development, and demonstrates why web security isn't just for administrators and back-end programmers any more. It's also for web developers who accept the responsibility that comes with using the new wonders of the Web.

Product Details

* Amazon Sales Rank: #825509 in Books
* Published on: 2007-07-11
* Format: Illustrated
* Number of items: 1
* Binding: Paperback
* 250 pages

Editorial Reviews

About the Author
Christopher Wells has deployed security solutions for major healthcare, telecommunication, and financial industries, and is currently employed as an Information Security Consultant for a major financial institution. He is an accomplished applications security architect with over 10 years of application security experience. Christopher holds multiple security certifications including a Certified Information Security Systems Professional (CISSP), and holds a Bachelor degree from the University of Minnesota.
Customer Reviews

The title should be "An Introducing To Web Security"3
In its 211 pages, Christopher Wells written a good book with one bad feature: Barely speak about the title-theme. In my opinion, this book is a good guide to start your studies about web security. Its chapters covers issues like web-server security, secure ways to develop your applications, many demonstrations of threat exploits and how to protect your application to them.
My conclusion is: If you want start your studies in Web Security, go on and buy this book. If you already did this and want to learn specifically about AJAX Security, try other book, because this one won't help you so much.

Wow, very disappointed...this is not an AJAX book1
I was really looking forward to this book as this topic is very important to my job. But there is very little AJAX-specific content. The closest it comes is chapter five that dabbles with JSON a bit.

If you want to secure AJAX applications, you can pass over this title and stick to the basics:

- Learn and apply holistic, defense-in-depth development principles. A great primer for this is Writing Secure Code, Second Edition.

- Dig deeper into web-specific practices--both development and networking/administration. Although a little outdated (references Windows 2000 a lot), the best book I have seen so far is Improving Web Application Security: Threats and Countermeasures.

- Just remember that AJAX is nothing more than using JavaScript at the client to pull back XML from the server, so your weakest points in your application can be hardened with plain 'ole input validation. Validate at the client to ensure you have a properly assembled HTTP request going out. Validate at the server to ensure incoming variables don't break any rules, and XML encode all user input (preferably using Microsoft's free Anti-XSS library) on the way back to the client to avoid cross-site scripting.

Recommended for any library catering to Ajax students and programmers.5
Christopher Wells' SECURING AJAX APPLICATIONS makes a startling comment: using Ajax can increase the risks of existing security flaws in a web site. That said, SECURING AJAX APPLICATIONS fixes many problems, showing how to locate dangerous gaps and cover them early on. Basic security techniques and known vulnerabilities are examined in an overview of not just Ajax but the evolving web platform as a whole. Recommended for any library catering to Ajax students and programmers. Libraries will find compact and affordable the fine 'pocket references' produced by O'Reilly.