Web Security: A Developer's Guide
Tags
Summary
Web Security: A Developer's Guide is a security practice book for Web development professionals, written by American technical author John Paul Mueller and translated by Wen Zhengdong. In 2017, People's Posts and Telecommunications Press introduced it as part of the "Turing Programmer Series." The book is divided into five parts and 17 chapters, built around the central idea of "eliminating security risks at the source." Part 1 covers how to create a security plan, including defining the application environment, identifying Web application threats, understanding software security assurance (SSA), classifying data and resources, and assessing the risks posed by HTML, CSS, JavaScript, and third-party code. Part 2 covers successful coding practices, including interface development and input validation, reliable code and team protocols, introducing libraries safely, and using APIs and microservices with caution. Part 3 covers testing strategies, starting from "thinking like a hacker" and introducing how to build a test environment, common vulnerabilities (SQL injection, cross-site scripting, denial of service, etc.), testing in BYOD environments, and third-party penetration testing. Part 4 covers the maintenance cycle, touching on defining upgrades and updates, updating language suites, and reporting mechanisms. Part 5 covers security resources, guiding readers in tracking the latest threats and organizing security training. The book does not attempt to catalog every threat type; instead it focuses on principles and tools that let readers solve problems independently, and it is platform-agnostic, covering everything from smartphones to aging desktop machines. It includes secure programming examples based on HTML5, CSS3, and JavaScript and is suitable for front-end engineers, designers, testers, and product managers who want to embed security into their daily development workflow.
Editor's review
市面上讲Web安全的书，大多从“攻击手法”入手，读完让人草木皆兵，却不知道从何改起。这本书的思路刚好相反：它把安全当作一项可以通过流程管理的工程事项，从计划、编码、测试、维护到资源获取，串起一条完整的安全开发生命周期。 最值得一提的是它对“第三方”的处理。如今的Web应用几乎不可能手写全部功能，库、API、微服务层层嵌套，风险也随之从自己的代码转移到别人的代码里。书中用专门章节拆解库与框架的区别、API与库的区别、微服务的通信与传输层安全，并结合MailPoet、Heartbleed、Shellshock等真实事件说明风险是如何发生的——这类具体案例让抽象的安全原则变得可感知。 内容不绑定某一具体技术栈，示例基于HTML5、CSS3与JavaScript，任何平台的开发者都能对号入座。虽然原版成书较早，部分工具与产品信息已随时间变化，但“如何在团队里建立安全习惯”的思路并不过时。适合作为团队共读材料，逐章对照自己的开发流程做一次体检。
Who it's for
A good fit for
- 负责前端或全栈开发、希望把安全纳入日常编码流程的工程师。
- 需要与开发团队协作、理解安全风险边界的测试与运维人员。
- 对第三方库、API、微服务安全性缺乏判断力的技术负责人。
- 想系统了解Web安全工程化实践的计算机专业高年级学生。
Not a good fit for
- 想找渗透测试实操步骤、命令与漏洞利用代码的读者，本书偏管理流程而非攻防手册。
- 追求某一框架（如Spring Security、Django）具体配置细节的开发者。
- 寻找最新2024年后安全工具与漏洞清单的读者，原书信息已有时效局限。
Reading tips
- 先读第1章与第9章，建立“威胁—计划—测试”的整体框架，再回填中间章节的细节。
- 读完每一部分后，对照自己项目的代码库与发布流程列一份差距清单，比通读一遍更有收获。
- 书中的案例与产品信息多为成书时的状态，涉及具体工具时请另行查阅最新资料。
- 适合作为团队读书会材料，按5大部分分五次讨论，每次聚焦一个流程环节。
About the publisher
Posts & Telecom Press
China · Founded in 1953
Posts & Telecom Press is known for its strengths in science and technology, computing, and information and communications titles, and has extended its publishing into photography, art, software learning, and inspirational growth, giving it a fairly diverse range. Its catalog includes computing and communications works such as Refactoring and Patterns (Revised Edition) and Huawei Switch Learning Guide (Second Edition), alongside bilingual collector's editions such as The Little Prince (Chinese-English-French illustrated collector's edition), The Great Gatsby, and Three Days to See. Beijing Ten Years: 1980-1990 and Ghost Blade: WLOP Personal Illustration Collection reflect its presence in photography and art. Its authors include Antoine de Saint-Exupéry, Helen Keller, Joshua Kerievsky, Wang Da, Zhang Zhaozeng, and WLOP.
Contents
- Preface
- Part 1 Creating a Security Plan
- Chapter 1 Defining the Application Environment
- Chapter 2 Meeting User Needs and Expectations
- Chapter 3 Getting Third-Party Help
- Part 2 Employing Successful Coding Practices
- Chapter 4 Developing a Successful Interface
- Chapter 5 Building Reliable Code
- Chapter 6 Including Libraries
- Chapter 7 Using APIs with Caution
- Chapter 8 Considering Microservices
- Part 3 Creating Useful and Efficient Testing Strategies
- Chapter 9 Thinking Like a Hacker
- Chapter 10 Creating a Secure API Area
- Chapter 11 Checking Libraries and APIs for Vulnerabilities
- Chapter 12 Using Third-Party Testing
- Part 4 Implementing the Maintenance Cycle
- Chapter 13 Clearly Defining the Upgrade Cycle
- Chapter 14 Considering Update Options
- Chapter 15 Considering the Need for Reporting
- Part 5 Finding Security Resources
- Chapter 16 Tracking Current Security Threats
- Chapter 17 Getting the Necessary Training
- About the Author
- About the Cover
FAQ
这本书是讲攻防技术还是讲工程流程？
偏工程流程。它不教具体的漏洞利用手法，而是围绕安全计划、编码实践、测试策略、维护周期与资源获取五个环节，讲如何把安全嵌入开发流程中。
书中的技术内容会不会过时？
原版成书于2016年前后，书中提到的具体产品、工具版本与事件确有时代痕迹。但关于第三方库与API风险、升级与更新策略、团队安全培训的思路仍具参考价值，建议结合最新资料阅读。
需要什么基础才能读懂？
需要了解HTML、CSS、JavaScript的基本用法以及Web应用的大致运行方式。不要求安全领域背景，书中概念基本从零解释。
这本电子版和纸质版内容有差别吗？
电子版基于同一中文译本，正文内容一致，主要差别在于载体与检索便利性。电子版标注字数约23.9万字，与纸质版251页的篇幅对应。
书中的目录为什么分五大部分？
五部分对应安全工作的五个阶段：制订计划、编码实践、测试策略、维护周期、查找资源，构成一个完整闭环，便于读者按流程顺序对照自己的项目。
Comments
Find this book
This site is an index: you start “Search all sources” in your browser, and the entries it lists all point to third-party sites; please judge their availability yourself.
