Security of Web Mashups: A Survey

Abstract

Web mashups, a new web application development paradigm, combine content and services from multiple origins into a new service. Web mashups heavily depend on interaction between content from multiple origins and communication with different origins. Contradictory, mashup security relies on separation for protecting code and data. Traditional HTML techniques fail to address both the interaction/communication needs and the separation needs. This paper proposes concrete requirements for building secure mashups, divided in four categories: separation, interaction, communication and advanced behavior control. For the first three categories, all currently available techniques are discussed in light of the proposed requirements. For the last category, we present three relevant academic research results with high potential. We conclude the paper by highlighting the most applicable techniques for building secure mashups, because of functionality and standardization. We also discuss opportunities for future improvements and developments.

Enhancing Secure Web Mashups Development in Enterprise Environments

“…Unfortunately, this is usually the case: many mashup developers today [14] don't have enough knowledge to take security issues into account when they implement mashups [10,32]. Poorly implemented mashup applications provide a great opportunity for hackers.…”

“…Despite these benefits, there are many security and privacy concerns associated with Web mashups. In particular, security is a big concern for enterprise mashups [10,11,12,13]. Many mashup applications often include components from third parties.…”

Information-Flow Security for a Core of JavaScript

“…A recent survey of the area [38] identifies a number of approaches ranging from isolation of components to their full integration. The focus of this paper is tight yet secure integration for scenarios when isolation is too restrictive and full integration is insecure.…”

Boosting the Permissiveness of Dynamic Information-Flow Tracking by Testing

“…The state of the art in web mashup security [24] leaves the question open. A range of approaches from separation to full integration has been suggested, tailored to web mashup scenarios such as online ads, where access-control policies are sufficient.…”