Cybersecurity Books: Application security

Part five of nine. The block for developers: the vulnerabilities you introduce yourself, and the ways not to introduce them.

Almost everything on this list is applicable to your work on Monday morning.

A thick reference on attacks against the web. It says nothing about modern front ends or APIs, but its classification of vulnerabilities and its testing methodology remain the best in the genre.

Topics: authentication and session management mechanisms, access control, injections of every kind, attacks on application logic, attacks on the user, a methodology for walking an application end to end.

How browsers actually work and why the web's security model looks the way it does. Written by the person who found these problems.

Topics: origins and the same-origin rule, the DOM and its isolation, cookies and their limits, how the browser processes content, security headers, mechanisms inherited from the nineties.

A compact, current book for people who write code rather than test other people's. A good way in before the previous two.

Topics: how the browser and HTTP work, injections, XSS and CSRF, storing passwords safely, dependencies and the vulnerabilities in them, server configuration, defending against automated attacks.

On building security into the development process rather than treating it as a separate stage before release.

Topics: security requirements and design, secure coding, testing and tooling in the pipeline, handling secrets, the culture of collaboration between development and security.

The only book that teaches you to answer "what could go wrong here" systematically, before the code is written.

Topics: data flow diagrams, the STRIDE methodology, attack trees, prioritising the threats you find, integrating threat modelling into the workflow.

API security from basic authentication to distributed systems, with working code.

Topics: authentication and authorisation in APIs, tokens and where to keep them, OAuth 2 and OpenID Connect, rate limiting, security in microservices and Kubernetes, mutual TLS.

The protocol taken apart from the inside: the authors have you build the client, the authorisation server, and the protected resource with your own hands.

Topics: the OAuth 2 flows and when to use which, the usual implementation mistakes on the client and the server side, access and refresh tokens, JWT, the relationship with OpenID Connect.

The book's thesis: most vulnerabilities come from poor domain design rather than from a forgotten check. It shows how a strict domain model removes whole classes of errors.

Topics: types instead of validation, immutable objects, context boundaries, error handling, security in cloud and distributed architectures, working with legacy code.

Next part: defense and response.

The whole series:

1. Foundations
2. Offensive security
3. Reverse engineering and malware
4. Cryptography
5. Application security
6. Defense and response
7. The human attack vector
8. Nonfiction investigations
9. Fiction