دانلود کتاب امنیت برنامه‌های کاربردی وب

Many moons ago (well, it wasn’t that long ago, but the tech world moves so fast that programmer years are like dog years), I was put in charge of building and maintaining a system that would handle credit card information. Such systems have to meet the Payment Card Industry Data Security Standards (PCI DSS), which requires a grueling annual audit to ensure that you are meeting security requirements. One of these requirements is to train your development team each year about the key software vulnerabilities that might affect such a system and how to protect against them. “Right,” I thought. “This ought to be easy: the internet has so much freely accessible information about web application security.” It turned out that there was far too much to choose from. The internet is awash with so much information on web application security: detailed, disorganized, sometimes out of date or duplicative, and often aimed at cybersecurity professionals rather than working coders. I wanted something succinct and to the point. What are the most essential things to know if I could steal a day of every developer’s time? And how best could I structure that information? I certainly didn’t want to trap the whole development team in a conference room for 8 hours and make them sit through PowerPoint presentations of info they already mostly know. That frustration led me to create Hacksplaining.com and, eventually, to write this book. Web application security is a curious subject area, in that every programmer (even fresh out of boot camp or with a recent computer science degree in hand) will have a fair knowledge of it, but we tend to feel (quite correctly) that we should know a little bit more. Doing your own research on the web can feel like walking into a disorganized library and picking up random texts, hoping to gain some good insights. Furthermore, nobody loves going to their boss and admitting that they have gaps in their knowledge, so we tend to be a little insecure about what we might not know. With this book, I’ve tried to follow a few rules: • Everything essential to know about web application security is contained within these pages. • Everything here is useful to know. • I’ve tried not to leave too many questions unanswered for the curious reader. Security advice on the internet tends to be along these lines: “Just use antisnarfing tokens to protect against the snarf-warbling vulnerability, or else a hacker will snarf your warbles.” When I read this type of advice, I immediately begin to ask, “But how would you snarf someone’s warbles? How would I get a job as a snarf warbler?” I have the sudden desire to know everything about snarf warbling.