A User's and Programmer's View of the New JavaScript Security Model

Vinod Anupam, David M. Kristol, and Alain Mayer
Bell Laboratories, Lucent Technologies
600 Mountain Avenue
Murray Hill, NJ 07974
{anupam,dmk,alain}@bell-labs.com

Abstract
Introduction
Brief Introduction to JavaScript
Overview of our Security Model
- Security Policy and Access Control
- Management of Trust
The End User's View
- Signed JavaScript
The JavaScript Programmer's View
- Domain and URL Based Trust Management
- Fine-Grained Trust Management via SetPrivate
Security Code Layers and Hardening of the Mozilla Layer
- Finding the Subject Origin URL
- Finding the Object Origin URL
Our Implementation
Summary and Outlook
References
About this document ...

Alain Mayer
8/30/1999

This paper was originally published in the Proceedings of the 2nd USENIX Symposium on Internet Technologies & Systems, October 11-14, 1999, Boulder, Colorado, USA

Last changed: 25 Feb 2002 ml

Technical Program

Conference index

USENIX home