Social sign-on and social sharing are becoming an ever more popular feature of web
applications. This success is largely due to the APIs and support offered by prominent social …

We present new attacks and robust countermeasures for security-sensitive components,
such as single sign-on APIs and client-side cryptographic libraries, that need to be safely …

Millions of web users today employ their Facebook accounts to sign into more than one
million relying party (RP) websites. This web-based single sign-on (SSO) scheme is enabled …

Web applications are one of the most prevalent platforms for information and service
delivery over the Internet today. As they are increasingly used for critical services, web …

Correctly integrating third-party services into web applications is challenging, and mistakes
can have grave consequences when third-party services are used for security-critical tasks …

A web application today often utilizes web APIs to incorporate third-party services into its
functionality. Such API integration, however, is full of security perils: recent studies show that …

Service workers are a powerful technology supported by all major modern browsers that can
improve users' browsing experience by offering capabilities similar to those of native …

OAuth 2.0 provides an open framework for the authorization of users across the web. While
the standard enumerates mandatory security protections for a variety of attacks, many …

Client-side CSRF is a new type of CSRF vulnerability where the adversary can trick the
client-side JavaScript program to send a forged HTTP request to a vulnerable target site by …

This paper presents Nemesis, a novel methodology for mitigating authentication bypass and
access control vulnerabilities in existing web applications. Authentication attacks occur …