Browse Library
Sign In Start Free Trial
Close icon Search icon
Account
Browse Library Sign In Start Free Trial

Add to playlist

Create a Playlist

Modal Close icon
You need to login to use this feature.
  • Book Overview & Buying JavaScript Security
  • Table Of Contents Toc
JavaScript Security

JavaScript Security

By : Eugene Liang
2 (1)
Buy this Book
close
close
JavaScript Security

JavaScript Security

2 (1)
By: Eugene Liang
Buy this Book

Overview of this book

This book is for JavaScript developers having basic web development knowledge and also for those who want to explore the security issues that arise from the use of JavaScript. Prior knowledge of how JavaScript is used, such as for DOM manipulation or to perform Ajax operations, is assumed.
Table of Contents (8 chapters)
close
close
close
Preface
Icon
Preface
Icon
What this book covers
Icon
What you need for this book
Icon
Who this book is for
Icon
Conventions
Icon
Reader feedback
Icon
Customer support
Lock Free Chapter
1
1. JavaScript and the Web
Icon
1. JavaScript and the Web
Icon
JavaScript and your HTML/CSS elements
Icon
JavaScript beyond the client
Icon
JavaScript security issues
Icon
Summary
2
2. Secure Ajax RESTful APIs
Icon
2. Secure Ajax RESTful APIs
Icon
Building a RESTful server
Icon
Basic defense against similar attacks
Icon
Summary
3
3. Cross-site Scripting
Icon
3. Cross-site Scripting
Icon
What is cross-site scripting?
Icon
Examples of cross-site scripting
Icon
Defending against cross-site scripting
Icon
Summary
4
4. Cross-site Request Forgery
chevron up
Icon
4. Cross-site Request Forgery
Icon
Introducing cross-site request forgery
Icon
Other examples of CSRF
Icon
Other forms of protection
Icon
Summary
5
5. Misplaced Trust in the Client
Icon
5. Misplaced Trust in the Client
Icon
When trust gets misplaced
Icon
Summary
6
6. JavaScript Phishing
Icon
6. JavaScript Phishing
Icon
What is JavaScript phishing?
Icon
Examples of JavaScript phishing
Icon
Defending against JavaScript phishing
Icon
Summary
7
Index
Icon
Index

Introducing cross-site request forgery

Cross-site request forgery (CSRF) exploits the trust that a site has in a user's browser. It is also defined as an attack that forces an end user to execute unwanted actions on a web application in which the user is currently authenticated. We have seen at least two instances where CSRF has happened. Let's review these security issues now.

Examples of CSRF

We will now take a look at a basic CSRF example:

  1. Go to the source code provided for this chapter and change the directory to chp4/python_tornado. Run the following command:

    python xss_version.py

  2. Remember to start your MongoDB process as well.

  3. Next, open external.html found in templates, in another host, say http://localhost:8888. You can do this by starting the server, which can be done by running python xss_version.py –port=8888, and then visiting http://loaclhost:8888/todo_external. You will see the following screenshot:

    Adding a new to-do item

  4. Click on Add To Do, and fill in a new to-do item, as shown...

CONTINUE READING
83
Tech Concepts
36
Programming languages
73
Tech Tools
Icon Unlimited access to the largest independent learning library in tech of over 8,000 expert-authored tech books and videos.
Icon Innovative learning tools, including AI book assistants, code context explainers, and text-to-speech.
Icon 50+ new titles added per month and exclusive early access to books as they are being written.
JavaScript Security
End of Chapter 4
Next Chapter
notes
bookmark Notes and Bookmarks search Search in title playlist Add to playlist font-size Font size

Change the font size

margin-width Margin width

Change margin width

day-mode Day/Sepia/Night Modes

Change background colour

Close icon Search
Country selected
Close icon Your notes and bookmarks

Confirmation

Modal Close icon
claim successful
Order Page Read Now

Buy this book with your credits?

Modal Close icon
Are you sure you want to buy this book with one of your credits?
Close
YES, BUY

Submit Your Feedback

Modal Close icon
Modal Close icon
Modal Close icon