Principled and Practical Web Application Security (2015) [pdf]
cseweb.ucsd.edu