Javascript security, Apuntes de Programación de Ordenadores

¡Descarga Javascript security y más Apuntes en PDF de Programación de Ordenadores solo en Docsity!

www.allitebooks.com

JavaScript Security Learn JavaScript security to make your web applications more secure Y.E Liang BIRMINGHAM - MUMBAI

www.allitebooks.com

Credits Author Y.E Liang Reviewers Jan Borgelin Sergio Viudes Carbonell Moxley Stratton Mihai Vilcu Commissioning Editor Kunal Parikh Acquisition Editor Llewellyn Rozario Content Development Editors Shali Sasidharan Anila Vincent Technical Editor Mrunal M. Chavan Copy Editors Sarang Chari Rashmi Sawant Project Coordinator Neha Bhatnagar Proofreaders Simran Bhogal Maria Gould Ameesha Green Paul Hindle Indexer Tejal Soni Production Coordinator Aparna Bhagat Cover Work Aparna Bhagat

www.allitebooks.com

About the Author

Y.E Liang is a researcher, author, web developer, and business developer. He has

experience in both frontend and backend development, particularly in engineering, user experience using JavaScript/CSS/HTML, and performing social network analysis. He has authored multiple books and research papers.

www.allitebooks.com

After writing his first program in 1981 in BASIC on a Commodore CBM 8032,

Moxley Stratton was hooked to programming. His interests include open source

software, object-oriented design, artificial intelligence, Clojure, and computer language theory. In his past jobs, he has written software in JavaScript, CoffeeScript, Java, PHP, Perl, and C. He is currently employed with Househappy as a senior backend engineer. He enjoys playing jazz piano, surfing, snowboarding, hiking, and spending time with his daughter.

"Software testing excellence" is the motto that drives Mihai Vilcu. Having gained

exposure to top technologies in both automated and manual testing, functional and nonfunctional, he became involved in numerous large-scale testing projects over several years. Some of the applications covered by him in his career include CRMs, ERPs, billing platforms, rating, collection, payroll, and business process management applications. Currently, as software platforms are becoming more popular in many industries, Mihai has worked in fields such as telecom, banking, healthcare, software development, Software as a Service (SaaS), and more. You can contact him at [email protected] for questions regarding testing.

www.allitebooks.com

www.PacktPub.com Support files, eBooks, discount offers, and more For support files and downloads related to your book, please visit www.PacktPub.com. Did you know that Packt offers eBook versions of every book published, with PDF and ePub files available? You can upgrade to the eBook version at www.PacktPub. com and as a print book customer, you are entitled to a discount on the eBook copy. Get in touch with us at [email protected] for more details. At www.PacktPub.com, you can also read a collection of free technical articles, sign up for a range of free newsletters and receive exclusive discounts and offers on Packt books and eBooks. http://PacktLib.PacktPub.com Do you need instant solutions to your IT questions? PacktLib is Packt's online digital book library. Here, you can search, access, and read Packt's entire library of books. Why subscribe?

• Fully searchable across every book published by Packt
• Copy and paste, print, and bookmark content
• On demand and accessible via a web browser Free access for Packt account holders If you have an account with Packt at www.PacktPub.com, you can use this to access PacktLib today and view 9 entirely free books. Simply use your login credentials for immediate access.

www.allitebooks.com

Table of Contents

Table of Contents

Preface

Security issues arise from both server and client weaknesses. In this book, you will learn the basics of these security weaknesses, how to recognize them, and how to prevent them.

What this book covers

Chapter 1 , JavaScript and the Web , provides a broad overview of the role of JavaScript in the Web. You will learn that JavaScript, besides giving behavior to web pages, can do a lot more today. JavaScript is now not only used on the client side, but also on the server side. JavaScript is almost the de facto standard way to create delightful experiences on the Web. Chapter 2 , Secure Ajax RESTful APIs , touches upon using JavaScript in tandem with RESTful APIs. We will learn how to make basic GET and POST calls to an endpoint. Subsequently, we will learn how to make malicious requests. From this chapter, we will learn more about some specific topics. Chapter 3 , Cross-site Scripting , explains what cross-site scripting is and helps you understand how such issues can occur. Most importantly, you will also learn how to minimize such risks. Chapter 4 , Cross-site Request Forgery , explains what cross-site forgery is and helps you understand how such issues can occur. Most importantly, you will also learn how to minimize such risks. Chapter 5 , Misplaced Trust in the Client , discusses a broad topic that can take place in many forms. In general, misplaced trust in the client takes place when the author's JavaScript code doesn't work as intended due to malicious actions by an adversary. Chapter 6 , JavaScript Phishing , explores the different ways in which JavaScript can be used to achieve a malicious end. JavaScript phishing is usually associated with online identity theft and privacy intrusion.

Preface [ 3 ] .always(function() { alert( "finished" ); }); When we wish to draw your attention to a particular part of a code block, the relevant lines or items are set in bold: var express = require('express'); var bodyParser = require('body-parser'); var app = express(); var session = require('cookie-session'); var csrf = require('csrf'); app.use(csrf()); app.use(bodyParser()); Any command-line input or output is written as follows: sudo pip install tornado==3. sudo pip install pymongo sudo pip install tornado-cors New terms and important words are shown in bold. Words that you see on the screen, for example, in menus or dialog boxes, appear in the text like this: "Click on Submit ." Warnings or important notes appear in a box like this. Tips and tricks appear like this. Reader feedback Feedback from our readers is always welcome. Let us know what you think about this book—what you liked or disliked. Reader feedback is important for us as it helps us develop titles that you will really get the most out of. To send us general feedback, simply e-mail [email protected], and mention the book's title in the subject of your message. If there is a topic that you have expertise in and you are interested in either writing or contributing to a book, see our author guide at www.packtpub.com/authors.

Preface [ 4 ] Customer support Now that you are the proud owner of a Packt book, we have a number of things to help you to get the most from your purchase. Downloading the example code You can download the example code files for all Packt books you have purchased from your account at http://www.packtpub.com. If you purchased this book elsewhere, you can visit http://www.packtpub.com/support and register to have the files e-mailed directly to you. Errata Although we have taken every care to ensure the accuracy of our content, mistakes do happen. If you find a mistake in one of our books—maybe a mistake in the text or the code—we would be grateful if you could report this to us. By doing so, you can save other readers from frustration and help us improve subsequent versions of this book. If you find any errata, please report them by visiting http://www.packtpub. com/submit-errata, selecting your book, clicking on the Errata Submission Form link, and entering the details of your errata. Once your errata are verified, your submission will be accepted and the errata will be uploaded to our website or added to any list of existing errata under the Errata section of that title. To view the previously submitted errata, go to https://www.packtpub.com/books/ content/support and enter the name of the book in the search field. The required information will appear under the Errata section. Piracy Piracy of copyright material on the Internet is an ongoing problem across all media. At Packt, we take the protection of our copyright and licenses very seriously. If you come across any illegal copies of our works, in any form, on the Internet, please provide us with the location address or website name immediately so that we can pursue a remedy. Please contact us at [email protected] with a link to the suspected pirated material. We appreciate your help in protecting our authors, and our ability to bring you valuable content.

JavaScript and the Web

First of all, welcome to the book! In this chapter, I will give a very high-level overview of JavaScript, such as some of the basic things it can do on the Web both on the client side and on the server side. After that, I will dive into some of the basic examples of JavaScript security issues. Here's what we will learn in this chapter:

• The relationship of JavaScript with HTML/CSS
• Some basic usage of jQuery, a popular JavaScript library
• A high-level overview of JavaScript security

JavaScript and your HTML/CSS elements

JavaScript provides behavior to your web pages. From changing your HTML elements' positioning to performing Ajax operations, there are many things that JavaScript can do now compared to just a few years ago. Here's just a basic list of things that JavaScript can do:

• Perform animation
• Add in content
• Create single-page applications
• Use third-party JavaScript widgets, such as Google Analytics and Facebook's social plugins Most importantly, with the rise of JavaScript libraries, such as jQuery, AngularJS, ReactJS, and more, achieving all this has never been easier. We'll see multiple examples of JavaScript with the use of jQuery just to give you a taste of some of the code we will see and use throughout this book.

www.allitebooks.com