Cross-Cutting Concerns

Question 1

What is HTTPS?

Answer 1

End-to-end security based on TLS

Question 2

Give the seven protocols/policies that increase Web security.

Answer 2

• HTTPS

Simple Access Authentication (run over HTTPS):
* Basic Authentication
* HTTP Digest Access Authentication

Authorisation and Identity:
* OAuth 2.0 (Authorisation)
* OpenID Connect (Authentication)

• Same-Origin Policy
• Cross-Origin Resource Sharing (CORS) protocol

Question 3

What three considerations should be made for Web security regardless of protocols/policies employed.

Answer 3

• Many more attacks possible
• Formal methods are required to prove correctness of protocols.
• The browser has become a very sophisticated software system, subject to many potential attacks

Question 4

Discuss Scalability in Web Security.

Answer 4

Protocols have become more involved!
* HTTPS setup costs
* OAUTH interactions
* Preflight requests for Cross-Origin Resource Sharing

Question 5

Give the six governing bodies (governance) of Web security.

Answer 5

• W3C World Wide Web Consortium
• IETF
• OpenID
• WhatWG
• EU privacy laws (Cookie Law)
• CAs and browser developers

Question 6

Describe two ways in which the web layer is self-describable in relation to Web security.

Answer 6

• WWW-Authenticate header
• Use of OPTIONS and HEAD to query service for CORS and Security