WAIT: Protecting the Integrity of Web Applications with Binary-Equivalent Transparency

TL;DR

WAIT enhances web application security by enabling browsers to verify client-side code integrity through publicly verifiable logs, increasing transparency and accountability against malicious modifications.

Contribution

The paper introduces WAIT, a novel system that makes client-side web application modifications transparent and verifiable, addressing a gap in existing security mechanisms.

Findings

Browser extensions enable local integrity validation.

Web servers include a custom HTTP header for transparency.

Verifiable logs allow browsers to detect undisclosed modifications.

Abstract

Modern single page web applications require client-side executions of application logic, including critical functionality such as client-side cryptography. Existing mechanisms such as TLS and Subresource Integrity secure the communication and provide external resource integrity. However, the browser is unaware of modifications to the client-side application as provided by the server and the user remains vulnerable against malicious modifications carried out on the server side. Our solution makes such modifications transparent and empowers the browser to validate the integrity of a web application based on a publicly verifiable log. Our Web Application Integrity Transparency (WAIT) approach requires (1) an extension for browsers for local integrity validations, (2) a custom HTTP header for web servers that host the application, and (3) public log servers that serve the verifiable logs. With WAIT, the browser can disallow the execution of undisclosed application changes. Also, web application providers cannot dispute their authorship for published modifications anymore. Although our approach cannot prevent every conceivable attack on client-side web application integrity, it introduces a novel sense of transparency for users and an increased level of accountability for application providers particularly effective against targeted insider attacks.