The Tangled Web: A Guide to Securing Modern Web Applications (2011)
This is a great book and is one of the three books we'd send to all candidates at Matasano. A thing to be aware of: it's probably the best all-around browser security book, but it's not the best application security book, since it spends much more time on browsers and browser technology than it does on the serverside issues (like SQL databases and authorization systems) that dominate web appsec.At Matasano, we gave The Web Application Hacker's Handbook to candidates to cover that gap.