Another good source of info - produced by ThoughtWorks:

https://martinfowler.com/articles/web-security-basics.html