The Tangled Web: A Guide to Securing Modern Web Applications

by Michael Zalewsi

Michal Zalewski's The Tangled Web provides a deep exploration of web browser security and the chaotic landscape of web standards that create security vulnerabilities. Rather than cataloging specific attack techniques, Zalewski dissects the fundamental building blocks of the web, including URL parsing, HTTP protocol behavior, HTML rendering, CSS processing, JavaScript execution, and the same-origin policy, to explain why web security is so difficult. Each chapter covers a different layer of the web stack, documenting the inconsistencies between browser implementations, the historical accidents that created security holes, and the defense mechanisms that attempt to contain the resulting chaos. The book is essential reading for anyone building or testing web applications, as it provides the foundational understanding of browser behavior that makes both attacks and defenses make sense.