Loading...
Please wait, while we are loading the content...
Similar Documents
Toward principled browser security.
| Content Provider | CiteSeerX |
|---|---|
| Author | Yang, Edward Z. Stefan, Deian Mitchell, John Mazières, David Marchenko, Petr Karp, Brad |
| Abstract | To ensure the confidentiality and integrity of web content, modern web browsers enforce isolation between content and scripts from different domains with the same-origin policy (SOP). However, many web applications require cross-origin sharing of code and data. This conflict between isolation and sharing has led to an ad hoc implementation of the SOP that has proven vulnerable to such attacks as cross-site scripting, cross-site request forgery, and browser privacy leaks. In this paper, we argue that information flow control (IFC) not only subsumes the same-origin policy but is also more flexible and sound. IFC not only provides stronger confidentiality and integrity for today’s web sites, but also better supports complex sites such as mashups, which are notoriously difficult to implement securely under the SOP. 1 |
| File Format | |
| Access Restriction | Open |
| Subject Keyword | Toward Principled Browser Security Same-origin Policy Modern Web Browser Browser Privacy Leak Information Flow Control Different Domain Support Complex Site Web Content Web Site Ad Hoc Implementation Cross-origin Sharing Cross-site Request Forgery Cross-site Scripting |
| Content Type | Text |
