《Ajax应用程序安全Securing Ajax Applications_Christopher Wells_英文版》pdf电子书免费下载
下载方式一：
百度网盘下载地址：https://pan.baidu.com/s/1up6Q5CzTphMKnHWsyu1roA
百度网盘密码：1111
下载方式二：
http://ziliaoshare.cn/Download/ac_123552_pd_AjaxYYCXAQSecuringAjaxApplications_ChristopherWells_YWB.zip
|
|
作者：Christopher Wells 页数：251 出版社：empty |
《Ajax应用程序安全Securing Ajax Applications_Christopher Wells_英文版》介绍
RESTful WebServicesChristopher Wellsoreilly.comis more than a complete catalog of O'Reilly books.You'll also find links to news， events， articles， weblogs， samplechapters， and code examplesoreilly ne.cam is the essential portal for developers interested inopen and emerging technologies， including new platforms， programming languages， and operating systems.OReilly brings diverse innovators together to nurture the ideasthat spark revolutionary industries.We specialize in document-ing the latest tools and systems， translating the innovator'sknowledge into useful skills for those in the trenches.Visit con-ferences.oreilly.comfor our upcoming events.SafariBookshelf(safari.oreilly.com) is the premier online refer-ence library for programmers and IT professionals， Conductsearches across more than 1， 000 books.Subscriber sean zero inon answers to time-critical questions in am a tier of seconds.Read the books on your Bookshelf from cover to cover or sim-ply i lip to the page you need.Try it today for free.Securing Ajax ApplicationsBeng·Cambridge·Farnham·K on·Paris·Sebastopol·Taipei·TokyoConferencesSafariBooks hel.O'REILLY°
Securing Ajax Applicationsby Christopher WelsCopy nghr02007ChrstopherWes.All ng hts reserved.Printed in the Unired States of America，Pub shed by OR illy Media Inc.， 1005 Gravenstein Highway North， Sebastopol， CA 95472O'Really books maybe purchased for educational， business， or sales pro mn tional use.Online editionsare also available for most titles(safar.o reily.cam) For more information， contact ourcorporate/insti rub anal sales de parr ment：(800)998-9938orcorporate@toreily.com.Editor：Tatiana Ap and iCover Designer：Karen Mon to g meryProduction Editor：Mary BradyInterior Designer：David Futa toProduction Services：Tolman Creek DesignHl us trators：Robert Romano and Jessi my n ReadPrinting Hitory：July 2007：First Edition.Nuh ll Hand bok.he Nu shel Handbook logo and theORy loge are regs e redir de marks ofORly Media， In eSecungAjaxAppltaonstae image of a spot ed hyena， andrea ted traded rssate trademarks of O'Reily Me dui， In e.Many of the des ag nations used by manufacturers and sel rs to disn gush their products are claimed astrade mn arks.Where thus e designations appear in this book， and O Reily Media， Inc.was aware of ata dear kaan， the de gnatnshaveboenprmedinaps or ital capsWhile every precaution has been taken in the preparation of this book.the publisher and author assumenoresponibaityforertors or omissions， or for damages res uk ng from the use of the informati uncontained herein.BriThsbakuscsRapKovet， adublandlbelaythnnISBN-10：0-59652931-7ISBN-13：978-0-596-52931-4
PrefaceDeciding to add security to a web application is like deciding whether to wearclothes in the mom ing.Both decisions provide comfort and protection throughoutthe day， and in both cases the decisions are better made be for ch and rather than later.Just look around and ask yourself， “How open doI really want to be with my neigh-bors? Or， “How open doI really want them to be with me?”I's all about sharing.Wth websites sharing data via open APIs， we h services， andother new technologies we are experiencing the veritable Woodstock of the digitalage.Free love now takes the form of free content and services.Make mashups， notwebpages!All right， so let's get down to business，Believe it， or not， there is security in openness.Look at the United States govern-ment， for example.The openness of the U.S.governmental system is what helps keepit secure.Maybe that can work for us， too!Repeat after meSadly， it is not quite that easy--or is it?Checks and balan ices make governments workWe， the programmers， in order to build a more perfect Web； t next abl sh presence andensure server st ablity， provide for the common Web.promote general security， forour lv es and our past enty.do osdanandesabihthscorsut on.There are layers of cooperation and defense.Each layer provides defense indepthweb appli sonsecuntyiaseiousbusess.All webapp lat on safe or wil be yul.nerable to some form of attack The thing to remember is that most people are goodand security is implemented to thwart those who are not So， the chances of your appli-cation getting attacked are proportional to the number of bad apples out thereAudienceThis book is for programmers on the frontlines looking for a solid resource to helpthem protect their applications from harm.It is also for the developer or architectinterested in sharing or consuming content in a safeway.
Assumptions This Book Makesnames， directories， and Unix utilitiesThis book assumes basic developers'knowledge of the Internet and web applica-tions.It also assumes a general awareness of security problems that ean arise on theInternet.Knowledge of security methodologies and practices is helpful， but notrequired.Contents of This BookChapter 1， The Evolving WebRecounts how we got to where we are today on the Web.The chapter explainshow web technologies have evolved， and why we have such a tangled WebChapter 2， Web SecurityDesc n be s basic security terms， practices， and methodologies.It also lays out andidentifies the major vulnerabilities on the Web todayChapter 3， Securing Web TechnologiesDes en ibes all the diferent types of web communications.This chapter di seuss esbasic security measures that minimizers k and examines these cunty of severalInternet technologiesChapter 4， Protect ig the ServerWalks through ser ting up a secure webserver.It offers practical advice to helpprotect a server from threats on the InternetChapter 5， A Weak FoundationExplores the major protocols associated with web applications， where the seamsare， what the possible attack vectors might be， and some recommended counter-measures to help make applications more secureChapter 6， Securing WebServicesLooks at how webservices work， the moving parts， how web technologies suchExamines web API design and construction and points out some security pitfallsDiscusses the evolution of web APls and how they work.This chapter also looksat some of the major security issues with mashups， such as lack of trust andauthentication.It also tries to answer qucs tions， such as what is the worst thatIndicates menu titles， menu options， menu buttons， and keyboard acceleratorsIndicates new terms， URLs， email addresses， filenames， fle extensions， path-Indicates commands， options， switches， variables， attn but es， keys， functions，as Ajax can fit in， and what major areas requite security attentionChapter 7， Building Secure APIsalong the way.Chapter 8， Mashupscan happen， and howto balance openness and securityx|PrefaceConventions Used in This BookThe following typographical conventions are used in this book：PlaintextItalic(such a sAlt and Cr rl) .Constant widthtypes， classes， namespaces， methods， modules， properties， parameters， values，objects， events， event handlers.XML tags， HTML tags， macros， the contents offles， or the output from commands.Constant width boldShows commands or other text that should be typed literally by the user.Const on twidth i to licShows text that should be replaced wth user-supple d valuesUsing Code ExamplesThis hook is here to help you get your job done.In general， you may use the code inthis book in your programs and documentation.You do not need to contact us forpermission unless you're reproducing a significant portion of the code.For example，wr tinga program that uses several chunks of code from this book does not requirepermission.Selling or distr but in ga CD-ROM of examples from O'Rely books doesrequire permission.Answering a question by citing this book and quoting examplecode does not require permission.Incorporating a significant amount of examplecode from this book into your product's documentation does require permissionWe appreciate， but do not require， attr bution.An attribution usually in chu des thetitle， author.publisher， and ISBN.For example：“Securing Ajax Applications byChristopher Wells.Copyright 2007 Christopher Well， 978-0-596-52931-4.”lf you feel your use of codec xamples falls outside fair use or the permission givenabove，feelfreetocontactusatpermissions@oreilly.com.This icon sign ities a tip， suggestion， or general note.This icon indicates a warning or caution.Pre ace|x
CHAPTER 1The Evolving Web
People are flocking to the Web more than ever before， and this growth is beingdriven by applications that employ the ideas of sharing and collaboration.Websitessuch as GoogleMaps， MySpace， Yahoo!， Digg， and others arc introducing users tonew social and interactive features， to seeding communities， and to collecting andreusing allsorts of precious data.The slate has been wiped clean and the stage set for a new breed of web application.Everything old is new again.Relationships fuel this new Web.And service providers，such as Yahoo!， Google， and Microsoft， are all rushing to expose their wares.Ir's likea cami val!Everything is open.Everything is frec—atleast for now.But whom canyou trust?Though mesmerized by the possibilities， as developers， we must remain vigilant—forthe sakes of our users For us， it is criti e alto recognize that the fundamentals of webprogramming have not changed.What has changed is this notion of“opening”resources and data so that others might use that data in new and creative ways.Fur-thermore， with all this sharing going on we can't let ourselves forget that our applica-tions must still defend themselvesAs technology moves forward， and we find our applications becoming more interac-tive—sharing data between themselves and other sites—it raises a host of news ecu-rity concerns.Our applications might consist of services provided by multipleproviders(sites) each hosting its own piece of the application.The surface area of these applications grows too.There are more points to watch andguard against-expanding both with technologies such as AJAX on the chen t andREST or WebServices on the server.Luckily， we are nor left completely empty-handed.Web security is nor new.Thereare some effective techniques and bestpractices that we can apply to these newappli e ations.Today， web programming languages make it easy to build applications without hav-ing to worry about the underlying plumbing.The details of connection and protocol
have been abstracted away.In doing so developers have grown complacent with theirenvironments and in some cases are even more vulnerable to attack.Before we continue moving forward， we should look at how we got to where we aretodayThe Rise of the WebIn 1989， at a Conseil Euro pien pour la Recherche Nucleaire(CERN) research facilityin Switzerland， a researcher by the name of Tim Berners-Lee and his team cooked upa program and protocol to facilitate the sharing and communication of their particlephysics research.The idea of this new program was to be able to*link differenttypes of research documents together.What Berners-Lee and the others created was the start of a new protocol， HypertextTransfer Protocol(HTTP) ， and a new markup language， Hypertext Markup Lan-guage(HTML) .Together they makeup the WorldWide Web(WWW) .The abstract of the on ginal request for comment(RFC 1945) reads：The Hype t text Transfer Protocol(HTTP) is an applicaton-level protocol with the ght-ness and speed necessary for distributed， collabora ive， hypermedia information sys-tems.Iris a gene nc， sate less， object-oriented protocol which can be used for manytasks， stc has nameservers and ds tribu ied object management systems， through exten-sonofisrequstmetodskomm and) AicturofHITPistheypugotd ar presentation， allowing systems to be built independently of the data being trans terre d.HTTP has been in use by the World-Wide Web global information initiative since 1990.This specif e ation reflects commun usage of the protocol referred to as HTTP/1.0The official RFC our l nes everything there is to say abour HTTP and is located athttp：//tools.ietf.org/html/rfc2616.Ifyouhaveanytroublesleepingatnight， readingthis might help you outBe mers-Lee had set out to create away to collate his research documents to keepthings just one click away， It was really just about information and data organiza-tion； little did he know he was creating the foundation for today's commerceToday， wed on't even see HTTP unless we want to deliberately.It has， for the mostpart， been abstracted away from us.Yet， it is at the very heart of our applications.Hypertext Transfer Protocol(HTTP)There's this guy-let's call him Jim.He'san old-timer who can spin yarns about thefirst time he ever sat down at a PDP-11.He still has his first programs saved on paperrape and punch eards.He's one of the first developers who helped to create the Inter-net that we have come to know and love2|Chapter l：The E oh ing WebTo Jim， protocol level communication using HIT P is like breathing.In fact， hewould prefer to not use a browser at all， but rather just drop into a terminal windowand use good ol'telnetJim types：and gets back：There are no GUIs or clunky browsers to get in the way and obfuscate the code， justplaintext simple， clear， and truc.Jim loves talking to webservers this way.Hethinks that webservers are remarkable devices—very chatty.Jim also likes to observethe start and stop of each request and response cycle.Jims cesa different side of theWeb than most users will.He can see the actual data interchange and transactions asWhen Jim hooked up with the server using telnet he established a connection to theserver and began initiating an HTTP transaction.Next， hc evoked the HTTP GETcommand or method followed by the name of the resource that he wanted in thiscase， classic.html.This took the form of a specified Uniform Resource Identifier(URI) ， which is a path that the server associates with the location of the desiredFinally， he indicated his preference for protocol type and version to use for the trans-action.
《Ajax应用程序安全Securing Ajax Applications_Christopher Wells_英文版》目录
1.The Evolving Web..
The Rise of the Web
2.Web Security..
Security Basics
Risk Analysis
Common Web Application Vulnerabilities
3.Securing Web Technologies
How WebSites Communicate
Browser Security
Browser Plug-ins， Extensions， and Add-ons
4.Protecting the Server
Network Security
Host Security
WebServer Hardening
ApplicationServer Hardening
5.A Weak Foundation.
6.Securing WebServices
WebServices Overview
Security and WebServices
WebService Security
7.Building Secure APIs
Building Your Own APIs
Preconditions
Post conditions
Invariants
Security Con cems
RESTful WebServices
8.Mashups...
Index.