Foreword |
|
xv | |
Introduction |
|
xvii | |
Industry Analysis |
|
xix | |
Preface |
|
xxiii | |
Acknowledgments |
|
xxv | |
Biography |
|
xxvii | |
|
|
|
Chapter 1 Introduction to Mobile Security Development |
|
|
3 | (12) |
|
Understanding Secure Web Development |
|
|
3 | (1) |
|
|
3 | (1) |
|
|
4 | (1) |
|
Prerequisite Technologies |
|
|
5 | (1) |
|
Applying Architecture Tools to Security |
|
|
5 | (1) |
|
Creating Consistent Reusable Code from Project to Project |
|
|
5 | (1) |
|
Mobile Application Using HTML5, AJAX, and jQuery Mobile |
|
|
5 | (1) |
|
Mobile App---A Social Mashup |
|
|
6 | (1) |
|
|
6 | (1) |
|
Client Application Layout |
|
|
6 | (1) |
|
|
6 | (1) |
|
Evolution of Security Measures |
|
|
7 | (1) |
|
SQL Injection to XSS to CSRF |
|
|
7 | (1) |
|
Battle for Output Context |
|
|
8 | (1) |
|
|
8 | (1) |
|
Bad Practices Invite Holes |
|
|
8 | (1) |
|
|
8 | (1) |
|
|
9 | (1) |
|
|
9 | (1) |
|
A New Mindset for Web Application Security |
|
|
10 | (5) |
|
Chapter 2 Web Application Attack Surface |
|
|
15 | (22) |
|
|
15 | (1) |
|
|
16 | (1) |
|
|
16 | (1) |
|
|
17 | (1) |
|
Cross-Site Request Forgery |
|
|
18 | (1) |
|
|
18 | (1) |
|
Defending Input and Output Streams: First Glance |
|
|
19 | (1) |
|
|
19 | (1) |
|
|
20 | (1) |
|
|
21 | (1) |
|
|
21 | (1) |
|
Cross-Site Request Forgery |
|
|
21 | (4) |
|
Theory of Input Filtering and Output Escaping |
|
|
25 | (1) |
|
|
26 | (1) |
|
|
26 | (2) |
|
|
28 | (1) |
|
You Must Know Where Your Data Is Displayed |
|
|
28 | (9) |
|
Chapter 3 PHP Security Anti-Patterns |
|
|
37 | (28) |
|
|
37 | (1) |
|
Not Matching Data Character Set to Filter Character Set |
|
|
37 | (1) |
|
Not Designing with Content Security Policy Anti-Pattern |
|
|
38 | (1) |
|
One Size Fits All Anti-Pattern |
|
|
38 | (1) |
|
Misinformation Anti-Patterns |
|
|
38 | (1) |
|
|
39 | (1) |
|
Critical Data Type Understanding and Analysis |
|
|
40 | (1) |
|
Single Data Type Anti-Pattern |
|
|
40 | (5) |
|
All Incoming HTTP Data Are Strings |
|
|
45 | (2) |
|
Validation by Type Process |
|
|
47 | (2) |
|
Input Same as Output Anti-Pattern |
|
|
49 | (1) |
|
The Assumed Clean Anti-Pattern |
|
|
50 | (1) |
|
Improper mysql_real_escape_string() Usage |
|
|
50 | (1) |
|
Filtering versus Escaping versus Encoding |
|
|
51 | (1) |
|
Only One Output Context Anti-Pattern |
|
|
52 | (1) |
|
Lack of Planning Anti-Patterns |
|
|
52 | (1) |
|
Lack of Consistency Anti-Patterns |
|
|
52 | (1) |
|
Lack of Testing Anti-Patterns |
|
|
53 | (1) |
|
Parameter Omission Anti-Pattern |
|
|
53 | (3) |
|
Design Practices Anti-Patterns |
|
|
56 | (1) |
|
No Clear Separation of HTML and PHP Code Anti-Pattern |
|
|
56 | (1) |
|
Too Many Database Function Calls |
|
|
57 | (1) |
|
Misleading Filtering Anti-Pattern |
|
|
58 | (1) |
|
Too Many Quotes Anti-Pattern |
|
|
58 | (1) |
|
Raw Request Variables as Application Variables |
|
|
59 | (1) |
|
Common Direct URL Input Anti-Pattern |
|
|
59 | (1) |
|
Poor Error Management Practices |
|
|
60 | (1) |
|
Poor Cryptography Practices |
|
|
61 | (1) |
|
|
62 | (1) |
|
|
62 | (1) |
|
Overcoming Anti-Patterns: Patterns, Testing, Automation |
|
|
63 | (2) |
|
Chapter 4 PHP Essential Security |
|
|
65 | (12) |
|
A Consistent UTF-8 Character Set |
|
|
65 | (1) |
|
|
66 | (1) |
|
UTF-8 in the PHP Application |
|
|
66 | (1) |
|
UTF-8 in the Client Browser |
|
|
67 | (1) |
|
|
67 | (1) |
|
Input Validation: Account for Size and Type |
|
|
67 | (1) |
|
Escape Output: Account for Context |
|
|
67 | (1) |
|
|
68 | (1) |
|
Application Secrets Location Pattern |
|
|
68 | (1) |
|
|
68 | (1) |
|
Error Logging Process Pattern |
|
|
69 | (1) |
|
|
69 | (1) |
|
|
69 | (1) |
|
White Listing Acceptable Input |
|
|
69 | (1) |
|
PHP Security Design Best Practices Summary |
|
|
70 | (1) |
|
Architect Application Character Set |
|
|
70 | (1) |
|
Architect HTTP Request Patterns |
|
|
70 | (1) |
|
Architect HTTP Cookie Usage |
|
|
71 | (1) |
|
Architect Input Validation |
|
|
71 | (1) |
|
Architect Output Escaping |
|
|
71 | (1) |
|
Architect Session Management |
|
|
72 | (1) |
|
Protect Secret Files/Protect Included Files |
|
|
72 | (1) |
|
|
72 | (1) |
|
Protecting User Session Data |
|
|
72 | (1) |
|
Protect against CSRF Attacks |
|
|
73 | (1) |
|
Protect against SQL Injection Attacks |
|
|
73 | (1) |
|
Protect against XSS Attacks |
|
|
73 | (1) |
|
Protect against File System Attacks |
|
|
73 | (1) |
|
|
74 | (1) |
|
OWASP Recommendations for PHP |
|
|
74 | (1) |
|
|
74 | (1) |
|
Additional PHP Security Checklist |
|
|
75 | (1) |
|
Disable Dangerous PHP Functions |
|
|
75 | (2) |
|
Chapter 5 PHP Security Tools Overview |
|
|
77 | (24) |
|
|
77 | (1) |
|
Abstract Classes, Interfaces, Facades, Templates, Strategy, Factories, and Visitors |
|
|
77 | (3) |
|
Variable Variables: Power DRY |
|
|
80 | (1) |
|
|
81 | (1) |
|
|
81 | (2) |
|
DRY Enforcement Functions |
|
|
83 | (1) |
|
Type Enforcement Functions |
|
|
84 | (1) |
|
|
85 | (3) |
|
|
88 | (1) |
|
Cryptography and Hashing Functions |
|
|
89 | (1) |
|
|
89 | (2) |
|
|
91 | (1) |
|
Modern Salting and Randomization |
|
|
91 | (1) |
|
|
92 | (1) |
|
How to Inline Heredoc Functions |
|
|
92 | (2) |
|
|
94 | (1) |
|
Use Integer Values as Much as Possible |
|
|
94 | (1) |
|
Use Type Enforcement Everywhere You Can |
|
|
95 | (1) |
|
Enforce String Sizes and Numeric Ranges Politely |
|
|
95 | (1) |
|
Cut Strings before Filtering |
|
|
95 | (1) |
|
Keep Strings as Small as Possible for Filters and for SQL Tables |
|
|
96 | (1) |
|
|
96 | (2) |
|
The Reason for PDO Prepared Statements |
|
|
98 | (1) |
|
Deprecated Security Functions |
|
|
99 | (1) |
|
Modern Crypto versus Old Crypto |
|
|
100 | (1) |
|
Chapter 6 UTF-8 for PHP and MySQL |
|
|
101 | (14) |
|
|
101 | (1) |
|
|
101 | (1) |
|
|
101 | (1) |
|
How UTF-8 Affects Security |
|
|
102 | (1) |
|
|
102 | (1) |
|
UTF-8 MySQL Database and Table Creation |
|
|
102 | (2) |
|
UTF-8 PDO Client Connection |
|
|
104 | (1) |
|
Manual UTF-8 PDO/MySQL Connection How To |
|
|
104 | (1) |
|
PHP UTF-8 Initialization and Installation |
|
|
105 | (1) |
|
|
105 | (1) |
|
|
106 | (1) |
|
|
106 | (1) |
|
|
106 | (1) |
|
PHP UTF-8 Multi-Byte Functions |
|
|
107 | (1) |
|
UTF-8 Input validation Functions |
|
|
107 | (1) |
|
|
108 | (1) |
|
|
109 | (1) |
|
|
110 | (1) |
|
UTF-8 Configuration PHPUnit Testing |
|
|
111 | (1) |
|
Test PHP Internal Encoding |
|
|
111 | (1) |
|
|
111 | (1) |
|
PHPUnit Test Class for Asserting UTF-8 Configuration |
|
|
112 | (3) |
|
Chapter 7 Project Layout Template |
|
|
115 | (6) |
|
Every App Has Some Basic Similarities |
|
|
115 | (1) |
|
Project Layout Should Be Handled Consistently |
|
|
115 | (3) |
|
|
118 | (1) |
|
Separation of HTML Static Resources |
|
|
119 | (1) |
|
The Completely Commented Files |
|
|
120 | (1) |
|
PHP PDO/UTF-8 Security Checklist |
|
|
120 | (1) |
|
Chapter 8 Separation of Concerns |
|
|
121 | (8) |
|
What Is Separation of Concerns? |
|
|
121 | (1) |
|
|
122 | (1) |
|
|
122 | (2) |
|
Keep JavaScript Out of HTML |
|
|
124 | (2) |
|
|
126 | (1) |
|
|
126 | (1) |
|
Use of IDs and Classes in HTML |
|
|
127 | (1) |
|
|
128 | (1) |
|
|
129 | (14) |
|
|
131 | (1) |
|
MySQL UTF-8 Database and Table Creation Support |
|
|
132 | (1) |
|
|
133 | (1) |
|
Prepared Statement Examples |
|
|
133 | (2) |
|
Selecting Data and Placing into HTML and URL Context |
|
|
135 | (2) |
|
PDO SELECT Queries and Class Objects |
|
|
137 | (1) |
|
Quoting Values and Database Type Conversion |
|
|
137 | (1) |
|
PDO Manual Quoting Example |
|
|
138 | (1) |
|
PDO and WHERE IN Statements |
|
|
139 | (1) |
|
White Listing and PDO Quoting of Column Names |
|
|
140 | (1) |
|
|
141 | (2) |
|
Chapter 10 Template Strategy Patterns |
|
|
143 | (16) |
|
Template Pattern Enforces Process |
|
|
143 | (1) |
|
Account Registration Template |
|
|
143 | (2) |
|
Account Registration Template---Activation |
|
|
145 | (2) |
|
Strategy Pattern for Output Escaping |
|
|
147 | (1) |
|
|
147 | (2) |
|
Improved Escaping Strategy Class |
|
|
149 | (3) |
|
|
152 | (4) |
|
Testing the Cleaner Class |
|
|
156 | (2) |
|
Examples of Cleaner::getKey() Validation Usage |
|
|
158 | (1) |
|
Chapter 11 Modern PHP Encryption |
|
|
159 | (6) |
|
Using MCrypt for Two-Way Encryption |
|
|
159 | (3) |
|
Encrypting Hashed Passwords with Blowfish |
|
|
162 | (3) |
|
Chapter 12 Professional Exception and Error Handling |
|
|
165 | (16) |
|
Configuring PHP Error Environment |
|
|
166 | (1) |
|
Secure php.ini and Error Log Files |
|
|
166 | (1) |
|
|
167 | (1) |
|
Production Error Configuration for php.ini |
|
|
168 | (1) |
|
Development Error Configuration for php.ini |
|
|
168 | (1) |
|
PHP Error Level Constants |
|
|
168 | (1) |
|
|
169 | (1) |
|
Introduction to Exceptions |
|
|
169 | (5) |
|
Trapping All Errors and Exceptions |
|
|
174 | (1) |
|
Converting Errors to Exceptions |
|
|
174 | (2) |
|
|
176 | (1) |
|
Handle Fatal Errors with register_shutdown_function() |
|
|
177 | (4) |
|
|
|
Chapter 13 Secure Session Management |
|
|
181 | (14) |
|
|
181 | (1) |
|
|
182 | (1) |
|
Secure Session Management Checklist |
|
|
182 | (1) |
|
Session Checklist Details |
|
|
183 | (6) |
|
Setting Configuration and Setup |
|
|
189 | (2) |
|
Detecting Session Tampering |
|
|
191 | (1) |
|
Force Page Request over SSL |
|
|
192 | (1) |
|
|
192 | (1) |
|
|
193 | (2) |
|
Chapter 14 Secure Session Storage |
|
|
195 | (44) |
|
PHP Default Session Storage Overview |
|
|
196 | (1) |
|
Session Storage Life Cycle |
|
|
196 | (1) |
|
|
197 | (1) |
|
|
197 | (1) |
|
Session Management Configuration |
|
|
197 | (1) |
|
Configure Security before Session_Start() Is Called |
|
|
198 | (3) |
|
|
201 | (1) |
|
Encrypted Session Storage |
|
|
202 | (1) |
|
Encrypted Session Storage via MySQL |
|
|
202 | (1) |
|
Creating a Custom Session Handler in MySQL |
|
|
202 | (22) |
|
Encrypted Session Storage via File System |
|
|
224 | (5) |
|
Class SecureSessionFile Details |
|
|
229 | (10) |
|
Chapter 15 Secure Forms and Account Registration |
|
|
239 | (54) |
|
Secure User Registration and Login Process Overview |
|
|
239 | (1) |
|
Unlimited Password Length, Unlimited Password Characters |
|
|
240 | (1) |
|
Secure Form Landing Pages Are over SSL |
|
|
241 | (1) |
|
Secure Form Nonce---Prevent CSRF |
|
|
241 | (1) |
|
|
242 | (1) |
|
Class NonceTracker Listing |
|
|
242 | (2) |
|
Class NonceTracker Detail |
|
|
244 | (3) |
|
Form Input Validation Overview |
|
|
247 | (1) |
|
|
248 | (4) |
|
Registration Form Details |
|
|
252 | (2) |
|
Double Encryption of User Passwords |
|
|
254 | (3) |
|
|
257 | (4) |
|
AccountManager Details and Authorization Checks |
|
|
261 | (1) |
|
Email Verification and Activation System |
|
|
262 | (7) |
|
Future Proof Encryption Strength with Blowfish Rounds |
|
|
269 | (2) |
|
Secure Password Request Link |
|
|
271 | (1) |
|
Reauthorize on Privilege Elevation |
|
|
272 | (1) |
|
|
273 | (3) |
|
SessionManagement Details |
|
|
276 | (2) |
|
Secure Logout Details via SessionManager |
|
|
278 | (1) |
|
Privilege Elevation Protection System |
|
|
279 | (2) |
|
|
281 | (1) |
|
|
281 | (2) |
|
Secure Login Form Details |
|
|
283 | (2) |
|
Protect Pages via Authentication Check |
|
|
285 | (1) |
|
|
286 | (1) |
|
Secure Logout Page Details |
|
|
287 | (1) |
|
A Secure RememberMe Feature |
|
|
287 | (4) |
|
|
291 | (2) |
|
Chapter 16 Secure Client Server Form Validation |
|
|
293 | (30) |
|
PHP UTF-8 Input Validation |
|
|
293 | (1) |
|
|
293 | (1) |
|
Validating UTF-8 Names and Emails via RegEx |
|
|
294 | (3) |
|
PREG for PHP = PREG for JavaScript |
|
|
297 | (1) |
|
Server Side Regular Expressions |
|
|
297 | (5) |
|
JavaScript Validation via Regular Expressions |
|
|
302 | (1) |
|
jQuery Validation via Regular Expressions |
|
|
303 | (3) |
|
jQuery Password Strength Meter |
|
|
306 | (2) |
|
JavaScript and jQuery Escaping and Filtering |
|
|
308 | (1) |
|
Replace innerHTML with innerText |
|
|
309 | (1) |
|
Embedded HTML HyperLinks---Problems with innerHTML |
|
|
310 | (2) |
|
Insecure JavaScript Functions |
|
|
312 | (1) |
|
Preventing Double Form Submission |
|
|
313 | (1) |
|
Post-Redirect-Get Pattern for Form Processing |
|
|
313 | (1) |
|
|
314 | (1) |
|
|
315 | (2) |
|
Tracking Form Tokens to Prevent Double Submission |
|
|
317 | (2) |
|
Controlling Form Page Caching and Page Expiration |
|
|
319 | (1) |
|
Main Cache-Control Settings |
|
|
320 | (1) |
|
Microsoft Internet Explorer Extension |
|
|
321 | (1) |
|
Timestamping AJAX GET Requests |
|
|
321 | (1) |
|
Constructing Secure GET Request URLs |
|
|
321 | (2) |
|
Chapter 17 Secure File Uploading |
|
|
323 | (10) |
|
Basic Principles of Secure File Uploading |
|
|
323 | (1) |
|
Authentication of File Uploads |
|
|
324 | (1) |
|
Create White List of Allowable Types |
|
|
324 | (1) |
|
File Extensions and Types Are Meaningless |
|
|
324 | (1) |
|
Create a System-Generated File Name |
|
|
324 | (1) |
|
Always Store Uploaded Files Outside Web Root |
|
|
324 | (1) |
|
|
324 | (1) |
|
|
325 | (1) |
|
Limit Number of Uploaded Files |
|
|
325 | (1) |
|
|
325 | (1) |
|
|
325 | (1) |
|
Secure File Uploading to Database |
|
|
325 | (1) |
|
|
326 | (1) |
|
|
326 | (4) |
|
Retrieving Uploaded Images |
|
|
330 | (3) |
|
Chapter 18 Secure JSON Requests |
|
|
333 | (14) |
|
Building Secure JSON Responses |
|
|
333 | (1) |
|
Correct and Incorrect JSON |
|
|
333 | (1) |
|
Proper JSON Construction Depends on Array Construction |
|
|
334 | (2) |
|
Safe Array Construction with PDO Records |
|
|
336 | (1) |
|
Send and Receive JSON in PHP |
|
|
337 | (1) |
|
|
337 | (3) |
|
|
340 | (1) |
|
Parsing JSON Securely with JavaScript/jQuery |
|
|
341 | (1) |
|
|
342 | (1) |
|
Post and Parse JSON Response Example |
|
|
342 | (5) |
|
|
|
Chapter 19 Google Maps, YouTube, and jQuery Mobile |
|
|
347 | (30) |
|
|
347 | (1) |
|
|
348 | (1) |
|
Placing Videos inside Google Map InfoWindows |
|
|
348 | (1) |
|
Creating InfoWindow Markers |
|
|
349 | (1) |
|
HTML and jQuery Mobile Layout |
|
|
349 | (2) |
|
|
351 | (1) |
|
HTML Fragments Description |
|
|
352 | (1) |
|
YouTube Elements Description |
|
|
353 | (1) |
|
|
354 | (1) |
|
|
354 | (5) |
|
InfoWindow Marker with Playable Video |
|
|
359 | (4) |
|
Map Marker Database Table |
|
|
363 | (1) |
|
|
364 | (1) |
|
Data Repository Class: GMapData |
|
|
364 | (2) |
|
|
366 | (1) |
|
|
366 | (2) |
|
Inserting and Updating Markers |
|
|
368 | (5) |
|
|
373 | (4) |
|
Chapter 20 Twitter Authentication and SSL cURL |
|
|
377 | (16) |
|
|
377 | (1) |
|
Step 1 Create a Twitter Application |
|
|
377 | (1) |
|
Step 2 Exchange Twitter Credentials for Access Token |
|
|
378 | (1) |
|
Step 3 Request Tweets Using Access Token |
|
|
378 | (1) |
|
Step 4 Activate Tweet Links |
|
|
378 | (1) |
|
|
378 | (4) |
|
Fetching v1.1 Tweets via TweetFetcher |
|
|
382 | (1) |
|
Getting Twitter oAuth Token |
|
|
382 | (1) |
|
Setting SSL Verification for cURL |
|
|
383 | (2) |
|
Retrieve Latest Tweets from Timeline |
|
|
385 | (1) |
|
Creating and Filtering Hyperlinks from Plain Text |
|
|
385 | (2) |
|
Filtering Bad Tweet Examples |
|
|
387 | (1) |
|
Examples of Secure Processing with processTweet() |
|
|
387 | (1) |
|
|
388 | (5) |
|
Chapter 21 Secure AJAX Shopping Cart |
|
|
393 | (26) |
|
|
393 | (1) |
|
|
394 | (1) |
|
|
395 | (2) |
|
|
397 | (8) |
|
|
405 | (2) |
|
Making the PayPal Purchase |
|
|
407 | (1) |
|
Beginning the PayPal Transaction |
|
|
407 | (4) |
|
Securely Posting to PayPal |
|
|
411 | (2) |
|
Completing the PayPal Purchase |
|
|
413 | (4) |
|
|
417 | (2) |
|
Chapter 22 Common Facebook Canvas Vulnerability Points |
|
|
419 | (6) |
|
Saving Facebook RealTime Updates via PDO |
|
|
419 | (1) |
|
Reflecting JSON Coordinates |
|
|
420 | (1) |
|
|
421 | (1) |
|
|
421 | (1) |
|
JavaScript and JQuery Filters |
|
|
421 | (1) |
|
|
421 | (1) |
|
|
421 | (1) |
|
|
422 | (1) |
|
|
422 | (3) |
Appendix |
|
425 | (4) |
Index |
|
429 | |