Web Application Security
A few people asked for slides and links from the security talk from The Ajax Experience last week:
General Links:
- OWASP: Open Web App Security Project
- Security Resources from the OpenAjax Alliance Wiki
- Mozilla on Same-Origin Policy
XSS:
- Introductions from: Wikipedia and Apache
- Cheat Sheet: Long list of XSS vectors from RSnake
- Explanation of DOM Based XSS
- Explanation of Samy is my Hero worm
- Fairly old FAQ at CGI Security
- List of XSS holes in popular web applications
CSRF:
- Introduction from: Wikipedia and here
- Article by Chris Shiflett and CSRF Redirector test tool
- CSRF FAQ at CGI Security
- Array constructor overriding and setter overriding
- A solution: SameRefererOnly
- Protecting a JSON or JavaScript Service
Blogs: