Declaratively Specifying Security Policies For Web Applications
The complex architecture of browser technologies and dynamic characteristics of JavaScript make it difficult to ensure security in client-side web applications. Browser-level policies alone, such as Content Security Policy and Same-Origin Policy, are not sufficient because they are implemented inconsistently across browsers and can be bypassed. At the application level, however, there exists no specification language for expressing a wide range of security policies in a composable and reusable manner. In this paper we develop a declarative language for encoding an combining security policies in the context of JavaScript web applications. We explore JavaScript’s reflection capabilities to enforce these security policies dynamically. We validate our work by expressing common security policies encountered in the literature.
Paper (meta16-final6.pdf) | 208KiB |
Sun 30 Oct Times are displayed in time zone: Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna change
13:30 - 15:10: Security & Capability-based DesignsMETA at Matterhorn 3 Chair(s): Shigeru ChibaUniversity of Tokyo | |||
13:30 - 14:00 Talk | Declaratively Specifying Security Policies For Web Applications META Angel Luis Scull PupoSofware Languages Lab, Vrije Universiteit Brussel, Jens NicolayVrije Universiteit Brussel, Belgium, Elisa Gonzalez BoixVrije Universiteit Brussel Media Attached File Attached | ||
14:00 - 14:30 Talk | Virtual Values for Taint and Information Flow Analysis META Prakasam KannanSan Jose State University, Thomas H. Austin, Mark StampSan Jose State University, Tim Disney, Cormac FlanaganUniversity of California, Santa Cruz Media Attached File Attached | ||
14:30 - 15:00 Talk | Capability Safe Reflection for the Wyvern Language META Media Attached File Attached |