On the incoherencies in web browser access control policies

Proceedings - IEEE Symposium on Security and Privacy

Volumn , Issue , 2010, Pages 463-478

  Singh, Kapil ^a   Moshchuk, Alexander ^b   Wang, Helen J ^b   Lee, Wenke ^a  

^a GEORGIA INSTITUTE OF TECHNOLOGY   (United States)

^b MICROSOFT RESEARCH   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

ACCESS CONTROL POLICIES; BACKWARD COMPATIBILITY; REAL-WORLD; RUNTIMES; WEB APPLICATION; WEB DEVELOPERS;

ACCESS CONTROL; SECURITY SYSTEMS; WORLD WIDE WEB;

WEB BROWSERS;

EID: 77955224128     PISSN: 10816011     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/SP.2010.35     Document Type: Conference Paper

References (34)

1. st ACM Symposium on Operating Systems Principles (SOSP), Stevenson, WA, Oct. 2007.
2. C. Jackson and A. Barth, "Beware of Finer-Grained Origins," in Web 2.0 Security and Privacy (W2SP), Oakland, CA, May 2008. [Online]. Available: http://seclab.stanford.edu/websec/ origins/fgo.pdf
3. th USENIX Security Symposium, Montreal, Canada, Aug. 2009.
4. J. Ruderman, "Same Origin Policy for JavaScript," http://www.mozilla.org/projects/security/components/ same-origin.html. Accessed on Nov. 14, 2009.
5. "Alexa," http://www.alexa.com/.
6. "Document Object Model," http://www.w3.org/DOM/. Accessed on Nov. 14, 2009.
7. D. Kristol and L. Montulli, "HTTP State Management Mechanism," in IETF RFC 2965, Oct. 2000.
8. D. Flanagan, Javascript: The Definitive Guide. O'Reilly Media Inc., 2006.
9. M. Zalewski, "Browser Security Handbook," 2008, http:// code.google.com/p/browsersec/wiki/Main. Accessed on Nov. 14, 2009.
10. A. Barth, "HTTP State Management Mechanism," IETF Draft 2109, Feb 2010, http://tools.ietf.org/html/ draft-ietf-httpstate-cookie-03.
11. C. Jackson and A. Barth, "ForceHTTPS: Protecting HighSecurity Web Sites from Network Attacks," in WWW, 2008.
12. "HTML 5 Editor's Draft," October 2008, http://www.w3.org/ html/wg/html5/.
13. th USENIX Security Symposium, San Jose, CA, Jul. 2008.
14. "XMLHttpRequest," http://www.w3.org/TR/ XMLHttpRequest/. Accessed on Nov. 14, 2009.
15. "XMLHttpRequest Level 2," http://www.w3.org/TR/ XMLHttpRequest2/. Accessed on Nov. 14, 2009.
16. "Mitigating Cross-site Scripting With HTTP-only Cookies," http://msdn2.microsoft.com/en-us/library/ms533046.aspx. Accessed on Nov. 14, 2009.
17. "HttpOnly," http://www.owasp.org/index.php/HTTPOnly. Accessed on Nov. 14, 2009.
18. "Mozilla Foundation Security Advisory 2009-05: XMLHttpRequest allows reading HTTPOnIy cookies," http:// www.mozilla.org/security/announce/2009/ mfsa2009-05.html. Accessed on Nov. 14, 2009.
19. "Clickjacking," http://en.wikipedia.org/wiki/Clickjacking.
20. "Whats New in Internet Explorer 8," 2008, http:// msdn.microsoft.com/en-us/library/cc288472.aspx. Accessed on Nov. 14, 2009.
21. th International Conference on World Wide Web (WWW), Edinburgh, Scotland, May 2006.
22. M. Zalewski and F. Almeida, "Browser DOM Access Checker 1.01," http://lcamtuf.coredump.cx/dom-checker/. Accessed on Nov. 14, 2009.
23. C. Jackson and A. Barth, "Browserscope Security Test Suite," http://mayscript.com/blog/collinj/ browserscope-security-test-suite. Accessed on Nov. 14, 2009.
24. th International Conference on World Wide Web (WWW), Madrid, Spain, Apr. 2009.
25. E. Lawrence, "Fiddler web debugging tool," http://www. flddler2.com/flddler2/. Accessed on Nov. 14, 2009.
26. "FiddlerCore," http://flddler.wikidot.com/flddlercore. Accessed on Nov. 14, 2009.
27. "BugMeNot," http://www.bugmenot.com/. Accessed on Mar. 1, 2010.
28. M. O'Neal, "Cookie Path Best Practice," http://research. corsaire.com/whitepapers/040323-cookie-path-best-practice. pdf. Accessed on Nov. 14, 2009.
29. "Browserscope," http://www.browserscope.org/. Accessed on Nov. 14, 2009.
30. th Annual Network and Distributed Systems Security Symposium (NDSS), San Diego, CA, Feb. 2006.
31. th Network and Distributed System Security Symposium (NDSS), San Diego, CA, Feb. 2006.
32. th USENIX Security Symposium, San Jose, CA, Jul. 2008.
33. st Workshop on Hot Topics in Understanding Botnets (HotBots), Berkeley, CA, USA, 2007.
34. th USENIX Security Symposium, Boston, MA, Aug. 2007.