Web Content Signing with Service Workers
Thomas Sutter, Kevin Lapagna, Peter Berlich, Marc Rennhard, Fabio, Germann

TL;DR
This paper proposes a method using service workers to verify the integrity of JavaScript files in browsers, enhancing security even if HTTPS connections are compromised.
Contribution
It introduces a novel approach leveraging service workers to ensure content authenticity and integrity in web browsers, addressing HTTPS trust issues.
Findings
Service workers can validate JavaScript file integrity.
The approach detects malicious JavaScript files.
Enhances web security beyond HTTPS.
Abstract
Securing the communication between a web server and a browser is a fundamental task of securing the World Wide Web. Websites today rely heavily on HTTPS to set up secure connections. In recent years, several incidents undermined this trust and therefore the security of the HTTPS system. In this paper we introduce an approach allowing to secure JavaScript files in case a HTTPS connection between web server and browser is compromised. Our paper presents a solution to safeguard the user's browser so that it only processes content (e.g., JavaScript or HTML) that was genuinely provided by the web application service providers themselves. Our solution makes use of service workers, a recently proposed W3C Candidate Recommendation enabling applications to take advantage of persistent background processing, including hooks to enable bootstrapping of web applications while offline. It…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsSpeech and dialogue systems · Multimedia Communication and Technology · Usability and User Interface Design
