Everand Logo

Welcome to Everand!

  • Discover millions of ebooks, audiobooks, and so much more with a free trial

    Only $11.99/month after trial. Cancel anytime.

    JavaScript Security
    JavaScript Security
    JavaScript Security
    Ebook203 pages1 hour

    JavaScript Security

    By Y.E Liang

    4/5

    ()

    Read preview

    About this ebook

    This book starts off with an introduction to JavaScript security and gives you an overview of the basic functions JavaScript can perform on the Web, both on the client side and the server side. It demonstrates a couple of ways in which RESTful APIs can be laden with security flaws. You will also create a simple RESTful server using Express.js and Node.js. You will then focus on one of the most common JavaScript security attacks, cross-site scripting, and how to prevent cross-site scripting and cross-site forgery.

    Last but not least, the book covers JavaScript phishing, how it works, and ways to counter it.

    By the end of this book, you will be able to identify various risks of JavaScript and how to prevent them.

    LanguageEnglish
    PublisherPackt Publishing
    Release dateNov 22, 2014
    ISBN9781783988013
    JavaScript Security

    Related to JavaScript Security

    Related ebooks

    Programming For You

    View More
    View More

    Related podcast episodes

    Related articles

    • Article

      GO Inside Parsing – How Go Handles The Code

      Jul 30, 2019

      This tutorial has two aspects: a theoretical one and a practical one. In the theoretical part, you will learn about parsing, grammar and regular expressions; this is how languages are built and therefore understood in terms of construction and usage.

      8 min read

    • Article

      DJANGO Create A Database-driven Website

      Jun 4, 2019

      The Django web framework was named after the famous guitarist Django Reinhardt and was first created by web developers at a small newspaper in Kansas. The main goals of Django is to enable fast development of complex websites with database needs. It

      7 min read

    • Article

      FLASK Web Frameworks

      Jun 4, 2019

      The main focus of Python has always been to get you cracking on with your coding – the language was never made for web programming. However, this has just made it more interesting to extend the language for the web, or to create an interface to web-b

      9 min read

    • Article

      Access Your Mac Anywhere

      Nov 8, 2022

      Access Your Mac Anywhere
      2 min read

    • Article

      Web App Security

      Jun 29, 2021

      Web App Security
      8 min read

    • Article

      “If ‘Show Password’ Is Enabled, The Feature Sends Your Password To Their Third-party Servers”

      Dec 8, 2022

      Like most people who write for a living, I lean heavily on my spoil chicken to get me through the day. Sorry, I mean spell checker. It’s not just professional writers, either: spell checkers have become de rigueur for business users and consumers ali

      7 min read

    • Article

      “Bad People Will Use Good Tools To Create Malicious Things. That’s Just A Fact Of Life”

      Mar 9, 2023

      You can’t have escaped the hype surrounding the OpenAI-powered writing tool ChatGPT. For once, it might even be deserving of that hype, though it’s still early days as far as such things go. For sure, you can ask it to produce a blog on most any give

      6 min read

    • Article

      Business Endpoint Protection

      Nov 11, 2021

      Business Endpoint Protection
      3 min read

    • Article

      “Why Are The Stupid Rules There In The First Place? Because Someone Had To Tick A Compliance Box”

      Jul 9, 2022

      I hate passwords with a vengeance. In the main because they are so badly abused, from a security perspective, by so many people. I’m not just talking about the person on the Clapham omnibus who keeps their passwords simple and shared between multiple

      7 min read

    • Article

      Digital Connection

      May 1, 2022

      Digital Connection
      6 min read

    • Article

      Smartproxy

      Jan 9, 2024

      Smartproxy
      2 min read

    • Article

      Protect Your Tech

      Oct 26, 2022

      Protect Your Tech
      2 min read

    • Article

      Scroll Media

      Sep 16, 2018

      You have been in the digital advertising industry since 2001, what changes have you seen and what’s your view on it today? It seems we have come a long way from faxing order forms across town and fixed weekly rates, so any automation is a good thing.

      3 min read

    • Article

      Don’t Panic

      Jun 17, 2019

      Don’t Panic
      8 min read

    Related categories

    Reviews for JavaScript Security

    4/5

    1 rating1 review

    What did you think?

    Tap to rate

    Review must be at least 10 words

    • 4/5
      This is a review I wrote for purposes of testing. smoketest2 reviews on rails4. Still doesn't work. Maybe due to X-XXS-Protection.

    Book preview

    JavaScript Security - Y.E Liang

    Table of Contents

    JavaScript Security

    Credits

    About the Author

    About the Reviewers

    www.PacktPub.com

    Support files, eBooks, discount offers, and more

    Why subscribe?

    Free access for Packt account holders

    Preface

    What this book covers

    What you need for this book

    Who this book is for

    Conventions

    Reader feedback

    Customer support

    Downloading the example code

    Errata

    Piracy

    Questions

    1. JavaScript and the Web

    JavaScript and your HTML/CSS elements

    jQuery effects

    Hide/Show

    Toggle

    Animation

    Chaining

    jQuery Ajax

    jQuery GET

    jQuery getJSON

    jQuery POST

    JavaScript beyond the client

    JavaScript on the server side

    Full-stack JavaScript

    JavaScript security issues

    Cross-site request forgery

    Cross-site scripting

    Summary

    2. Secure Ajax RESTful APIs

    Building a RESTful server

    A simple RESTful server in Node.js and Express.js

    Frontend code for the to-do list app on top of Express.js

    Cross-origin injection

    Injecting JavaScript code

    Guessing the API endpoints

    Basic defense against similar attacks

    Summary

    3. Cross-site Scripting

    What is cross-site scripting?

    Persistent cross-site scripting

    Nonpersistent cross-site scripting

    Examples of cross-site scripting

    A simple to-do app using Tornado/Python

    Coding up server.py

    Cross-site scripting example 1

    Cross-site scripting example 2

    Cross-site scripting example 3

    Defending against cross-site scripting

    Do not trust users – parsing input by users

    Summary

    4. Cross-site Request Forgery

    Introducing cross-site request forgery

    Examples of CSRF

    Basic defense against CSRF attacks

    Other examples of CSRF

    CSRF using the tags

    Other forms of protection

    Creating your own app ID and app secret – OAuth-styled

    Checking the Origin header

    Limiting the lifetime of the token

    Summary

    5. Misplaced Trust in the Client

    When trust gets misplaced

    A simple example

    Building the server side – mistrust.py

    The templates

    To trust or not to trust

    Manipulating the JavaScript code

    Dealing with mistrust

    Summary

    6. JavaScript Phishing

    What is JavaScript phishing?

    Examples of JavaScript phishing

    Classic examples

    Accessing user history by accessing the local state

    XSS and CSRF

    Intercepting events

    Defending against JavaScript phishing

    Upgrading to latest versions of web browsers

    Recognizing real web pages

    Protecting your site against XSS and CSRF

    Avoid using pop ups and keep your address bars

    Summary

    Index

    JavaScript Security

    JavaScript Security

    Copyright © 2014 Packt Publishing

    All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, without the prior written permission of the publisher, except in the case of brief quotations embedded in critical articles or reviews.

    Every effort has been made in the preparation of this book to ensure the accuracy of the information presented. However, the information contained in this book is sold without warranty, either express or implied. Neither the author, nor Packt Publishing, and its dealers and distributors will be held liable for any damages caused or alleged to be caused directly or indirectly by this book.

    Packt Publishing has endeavored to provide trademark information about all of the companies and products mentioned in this book by the appropriate use of capitals. However, Packt Publishing cannot guarantee the accuracy of this information.

    First published: November 2014

    Production reference: 1141114

    Published by Packt Publishing Ltd.

    Livery Place

    35 Livery Street

    Birmingham B3 2PB, UK.

    ISBN 978-1-78398-800-6

    www.packtpub.com

    Credits

    Author

    Y.E Liang

    Reviewers

    Jan Borgelin

    Sergio Viudes Carbonell

    Moxley Stratton

    Mihai Vilcu

    Commissioning Editor

    Kunal Parikh

    Acquisition Editor

    Llewellyn Rozario

    Content Development Editors

    Shali Sasidharan

    Anila Vincent

    Technical Editor

    Mrunal M. Chavan

    Copy Editors

    Sarang Chari

    Rashmi Sawant

    Project Coordinator

    Neha Bhatnagar

    Proofreaders

    Simran Bhogal

    Maria Gould

    Ameesha Green

    Paul Hindle

    Indexer

    Tejal Soni

    Production Coordinator

    Aparna Bhagat

    Cover Work

    Aparna Bhagat

    About the Author

    Y.E Liang is a researcher, author, web developer, and business developer. He has experience in both frontend and backend development, particularly in engineering, user experience using JavaScript/CSS/HTML, and performing social network analysis. He has authored multiple books and research papers.

    About the Reviewers

    Jan Borgelin is a technical geek with over 15 years of professional software development experience. He currently works as the CTO at BA Group Ltd., a consultancy based in Finland. In his daily work with modern web applications, JavaScript security has become an increasingly important topic as more and more business logic is being implemented within browsers.

    Sergio Viudes Carbonell is a 32-year-old mobile developer (apps and games) from Elche, Spain.

    He studied Computer Science at the University of Alicante. Then, he worked on developing computer programs and web apps. Now, he works as a mobile developer, creating apps and video games for Android, iOS, and the Web.

    He has previously reviewed AndEngine for Android Game Development Cookbook and Mobile Game Design Essentials. Both of these books were published by Packt Publishing. Currently, he is reviewing Mastering AndEngine Game Development, Packt Publishing.

    I would like to thank the author of this book for writing it. A special thanks goes to my wife, Fani, who encourages and supports me every day.

    After writing his first program in 1981 in BASIC on a Commodore CBM 8032, Moxley Stratton was hooked to programming. His interests include open source software, object-oriented design, artificial intelligence, Clojure, and computer language theory. In his past jobs, he has written software in JavaScript, CoffeeScript, Java, PHP, Perl, and C. He is currently employed with Househappy as a senior backend engineer. He enjoys playing jazz piano, surfing, snowboarding, hiking, and spending time with his daughter.

    Software testing excellence is the motto that drives Mihai Vilcu. Having gained exposure to top technologies in both automated and manual testing, functional and nonfunctional, he

    Enjoying the preview?
    Page 1 of 1