The tangled Web

About the book

Michal Zalewski's book looks at web security from the browser outward. It explains the design pressures that produce exploits: a document format that became an application platform, an origin model built for a simpler web, and a long negotiation between sites that want capability and users who need isolation. The result is a technical account of how the browser's security boundaries are drawn and where they leak.

Zalewski writes from inside the field. The book moves between the standards that define browser behavior and the practical consequences of implementing them, covering the same-origin policy, content isolation, and the handling of untrusted input. Security here is an engineering discipline shaped by compatibility, not a checklist of vulnerabilities.

The subject is the browser as a security boundary, and the book's value lies in connecting policy decisions to the mechanisms that enforce them. Readers come away with a mental model of why web security is hard.

How to read it

Approach the book as an argument about design tradeoffs. Zalewski explains why particular protections exist and what they cost, so follow the reasoning rather than hunting for recipes. The prose is dense in places and assumes comfort with HTTP, scripting, and the basics of how a page loads.

Examples and standards references carry much of the weight. Read them as illustrations of a general problem, and expect some material to reflect the web as it stood when the book was written. The core questions about isolation and trust remain relevant; specific browser behaviors may not.

Who it suits

Web developers who want to understand the security model beneath the APIs they use will find the clearest benefit. Security engineers moving into browser or client-side work get a structured account of the boundary they are defending. Readers with a general interest in how large software systems balance capability against safety will also find the reasoning accessible, provided they bring some familiarity with web technology.

Reading considerations

Browser security has changed considerably since the book appeared. Treat specific implementation details as historical context and check current documentation before relying on them. The treatment is technical and assumes prior knowledge; readers new to web development may want a foundational text first.