The emergence of Web 2.0 technologies such as Ajax and Mashup has revealed the weakness of the same-origin policy [1], the current de facto standard for the Web browser security model. We propose a new browser security model to allow fine-grained access control in the clientside Web applications for secure mashup and user-generated contents. We propose a browser security model that is based on information-flow-based access control (IBAC) to overcome the dynamic nature of the client-side Web applications and to accurately determine the privilege of scripts in the event-driven programming model.
Yoshihama et al. REF present a browser security model that relies on information flow labels to enforce fine-grained access control, focusing on mashups.
Information-Flow-Based Access Control for Web Browsers
IEICE Transactions
IEICE Transactions
Computer Science