WebPol: Fine-grained Information Flow Policies for Web Browsers
Abhishek Bichhawat, Vineet Rajani, Jinank Jain, Deepak Garg, and Christian Hammer

TL;DR
WebPol introduces fine-grained, JavaScript-based policies for web browsers to better control third-party script access to confidential data, addressing limitations of existing coarse security mechanisms.
Contribution
It presents a novel policy mechanism allowing developers to specify detailed data access rules for third-party scripts within web pages.
Findings
Policies can be enforced with existing information flow tracking proposals.
WebPol's implementation demonstrates manageable performance overhead.
Fine-grained policies improve data security in web browsers.
Abstract
In the standard web browser programming model, third-party scripts included in an application execute with the same privilege as the application's own code. This leaves the application's confidential data vulnerable to theft and leakage by malicious code and inadvertent bugs in the third-party scripts. Security mechanisms in modern browsers (the same-origin policy, cross-origin resource sharing and content security policies) are too coarse to suit this programming model. All these mechanisms (and their extensions) describe whether or not a script can access certain data, whereas the meaningful requirement is to allow untrusted scripts access to confidential data that they need and to prevent the scripts from leaking data on the side. Motivated by this gap, we propose WebPol, a policy mechanism that allows a website developer to include fine-grained policies on confidential application…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsSecurity and Verification in Computing · Web Application Security Vulnerabilities · Advanced Malware Detection Techniques
