ARCA è l'archivio istituzionale ad accesso aperto della ricerca dell'Università Ca' Foscari Venezia e nasce nel 2014 con lo scopo di raccogliere, diffondere e conservare la produzione scientifica dell'Università. Costituisce di fatto il catalogo della ricerca di Ateneo.
ARCA è un sistema Open Access: è non solo consultabile da tutti e visibile nei motori di ricerca, ma anche interoperabile con il portale cerCa. In questo modo vengono valorizzate la produzione scientifica dell'Ateneo e la visibilità dei ricercatori.

Session cookies constitute one of the main attack targets against client authentication on the Web. To counter that, modern web browsers implement native cookie protection mechanisms based on the Secure and HttpOnly flags. While there is a general understanding about the effectiveness of these defenses, no formal result has so far been proved about the security guarantees they convey. With the present paper we provide the first such result, with a mechanized proof of noninterference assessing the robustness of the Secure and HttpOnly cookie flags against both web and network attacks. We then develop CookiExt, a browser extension that provides client-side protection against session hijacking based on appropriate flagging of session cookies and automatic redirection over HTTPS for HTTP requests carrying such cookies. Our solution improves over existing client-side defenses by combining protection against both web and network attacks, while at the same time being designed so as to minimise its effects on the user’s browsing experience.

Session cookies constitute one of the main attack targets against client authentication on the Web. To counter that, modern web browsers implement native cookie protection mechanisms based on the Secure and HttpOnly flags. While there is a general understanding about the effectiveness of these defenses, no formal result has so far been proved about the security guarantees they convey. With the present paper we provide the first such result, with a mechanized proof of noninterference assessing the robustness of the Secure and HttpOnly cookie flags against both web and network attacks. We then develop CookiExt, a browser extension that provides client-side protection against session hijacking based on appropriate flagging of session cookies and automatic redirection over HTTPS for HTTP requests carrying such cookies. Our solution improves over existing client-side defenses by combining protection against both web and network attacks, while at the same time being designed so as to minimise its effects on the user's browsing experience. © 2014 Springer International Publishing Switzerland.

Powered by IRIS-about IRIS-Utilizzo dei cookie

 Copyright © 2022