Web Security Model PDF

Web Security Model CS155 Computer and Network Security And now for something completely different! 1. Systems Security 2. Web Security Web Security Model Web Vulnerabilities and Attacks HTTPS, TLS, Certi cates User Authentication and Session Management 3. Network and Mobile Security...

Web Security Model CS155 Computer and Network Security And now for something completely different! 1. Systems Security 2. Web Security Web Security Model Web Vulnerabilities and Attacks HTTPS, TLS, Certi cates User Authentication and Session Management 3. Network and Mobile Security fi Web Security Goals Safely browse the web in the face of attackers Visit a web sites (including malicious ones!) without incurring harm Site A cannot steal data from your device, install malware, access camera, etc. Site A cannot a ect session on Site B or eavesdrop on Site B Support secure high-performance web apps (e.g., Google Meet) ff Web Attack Models Malicious Website Web Attack Models Malicious Website Malicious External Resource Web Attack Models Malicious Website Malicious External Resource Network Attacker Web Attack Models Malicious Website Malicious External Resource Network Attacker Malware Attacker Web Attack Models Malicious Website Malicious External Resource x Network Attacker Malware Attacker HTTP Protocol HTTP Protocol ASCII protocol from 1989 that allows fetching resources (e.g., HTML le) from a server - Two messages: request and response - Stateless protocol beyond a single request + response Every resource has a uniform resource location (URL): http://cs155.stanford.edu:80/lectures?lecture=08#slides scheme domain port path query string fragment id fi Anatomy of Request HTTP Request GET /index.html HTTP/1.1 Accept: image/gif, image/x-bitmap, image/jpeg, ** Accept-Language: en Connection: Keep-Alive User-Agent: Mozilla/1.22 (compatible; MSIE 2.0; Windows 95) Host: www.example.com Referer: http://www.google.com?q=dingbats Anatomy of Request HTTP Request method path version GET /index.html HTTP/1.1 Accept: image/gif, image/x-bitmap, image/jpeg, ** Accept-Language: en Connection: Keep-Alive User-Agent: Mozilla/1.22 (compatible; MSIE 2.0; Windows 95) headers Host: www.example.com Referer: http://www.google.com?q=dingbats body (empty) HTTP Response HTTP Response status HTTP/1.0 200 OK code Date: Sun, 21 Apr 1996 02:20:42 GMT Server: Microsoft-Internet-Information-Server/5.0 Content-Type: text/html headers Last-Modified: Thu, 18 Apr 1996 17:39:05 GMT Content-Length: 2543 Some data... announcement!... body HTTP GET vs. POST HTTP Request method path version POST /index.html HTTP/1.1 Accept: image/gif, image/x-bitmap, image/jpeg, */* Accept-Language: en User-Agent: Mozilla/1.22 (compatible; MSIE 2.0; Windows 95) headers Host: www.example.com Referer: http://www.google.com?q=dingbats Name: John Smith body Organization: Stanford University HTTP Methods GET: Get the resource at the speci ed URL (does not accept message body) POST: Create new resource at URL with payload PUT: Replace target resource with request payload PATCH: Update part of the resource DELETE: Delete the speci ed URL fi fi HTTP Methods Not all methods are created equal — some have different security protections GETs should not change server state; in practice, some servers do perform side effects - Old browsers don’t support PUT, PATCH, and DELETE - Most requests with a side affect are POSTs today - Real method hidden in a header or request body 🙅 Never do… GET http://bank.com/transfer?fromAcct=X&toAcct=Y&amount=1000 HTTP → Website When you load a site, your web browser sends a GET request to that website stanford.edu http://example.com GET /index.html stanford.edu Loading Resources Root HTML page can include additional resources like images, videos, fonts After parsing page HTML, your browser requests those additional resources stanford.edu http://example.com GET /img/usr.jpg stanford.edu External Resources There are no restrictions on where you can load resources like images Nothing prevents you from including images on a di erent domain stanford.edu http://example.com GET /img/usr.jpg bank.com ff Client Doesn’t Know Server Con guration! The browser doesn’t know what will be returned when they make a request to a web server! stanford.edu http://example.com GET /transfer?… bank.com fi Not only GETs! You can also submit forms to any URL similar to how you can load resources stanford.edu http://example.com POST /transfer bank.com Javascript Historically, HTML content was static or generated by the server and returned to the web browser to simply render to the user Today, websites also deliver scripts to be run inside of the browser Click me to display Date and Time. Javascript can make additional web requests, manipulate page, read browser data, local hardware — exceptionally powerful today Document Object Model (DOM) Javascript can read and modify page by interacting with DOM Object Oriented interface for reading/writing page content Browser takes HTML -> structured data (DOM)