at Google ScholarTitle data
Calzavara, Stefano ; Roth, Sebastian ; Rabitti, Alvise ; Backes, Michael ; Stock, Ben:
A Tale of Two Headers : A Formal Analysis of Inconsistent Click-Jacking Protection on the Web.
2020
Event: 29th USENIX Security Symposium
, 12.-14.08.2020
.
(Conference item: Conference
,
Paper
)
Abstract in another language
Click-jacking protection on the modern Web is commonly enforced via client-side security mechanisms for framing control, like the X-Frame-Options header (XFO) and Con- tent Security Policy (CSP). Though these client-side security mechanisms are certainly useful and successful, delegating protection to web browsers opens room for inconsistencies in the security guarantees offered to users of different browsers. In particular, inconsistencies might arise due to the lack of support for CSP and the different implementations of the un- derspecified XFO header. In this paper, we formally study the problem of inconsistencies in framing control policies across different browsers and we implement an automated policy analyzer based on our theory, which we use to assess the state of click-jacking protection on the Web. Our analysis shows that 10% of the (distinct) framing control policies in the wild are inconsistent and most often do not provide any level of protection to at least one browser. We thus propose recommendations for web developers and browser vendors to mitigate this issue. Finally, we design and implement a server-side proxy to retrofit security in web applications.
Further data
| Item Type: | Conference item (Paper) |
|---|---|
| Refereed: | Yes |
| Institutions of the University: | Faculties > Faculty of Mathematics, Physics und Computer Science Faculties > Faculty of Mathematics, Physics und Computer Science > Department of Computer Science |
| Result of work at the UBT: | No |
| DDC Subjects: | 000 Computer Science, information, general works 000 Computer Science, information, general works > 004 Computer science |
| Date Deposited: | 20 Jan 2025 10:56 |
| Last Modified: | 20 Jan 2025 10:56 |
| URI: | https://eref.uni-bayreuth.de/id/eprint/91466 |