{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,3,27]],"date-time":"2025-03-27T10:18:09Z","timestamp":1743070689923,"version":"3.40.3"},"publisher-location":"Cham","reference-count":35,"publisher":"Springer International Publishing","isbn-type":[{"type":"print","value":"9783030299613"},{"type":"electronic","value":"9783030299620"}],"license":[{"start":{"date-parts":[[2019,1,1]],"date-time":"2019-01-01T00:00:00Z","timestamp":1546300800000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2019,1,1]],"date-time":"2019-01-01T00:00:00Z","timestamp":1546300800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2019]]},"DOI":"10.1007\/978-3-030-29962-0_29","type":"book-chapter","created":{"date-parts":[[2019,9,14]],"date-time":"2019-09-14T23:03:29Z","timestamp":1568502209000},"page":"606-624","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":5,"title":["Testing for Integrity Flaws in Web Sessions"],"prefix":"10.1007","author":[{"given":"Stefano","family":"Calzavara","sequence":"first","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Alvise","family":"Rabitti","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Alessio","family":"Ragazzo","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Michele","family":"Bugliesi","sequence":"additional","affiliation":[],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"297","published-online":{"date-parts":[[2019,9,15]]},"reference":[{"key":"29_CR1","doi-asserted-by":"crossref","unstructured":"Akhawe, D., Barth, A., Lam, P.E., Mitchell, J.C., Song, D.: Towards a formal foundation of web security. In: Proceedings of the 23rd IEEE Computer Security Foundations Symposium, CSF 2010, pp. 290\u2013304 (2010)","DOI":"10.1109\/CSF.2010.27"},{"key":"29_CR2","doi-asserted-by":"crossref","unstructured":"Barth, A.: HTTP state management mechanism (2011). http:\/\/tools.ietf.org\/html\/rfc6265","DOI":"10.17487\/rfc6265"},{"key":"29_CR3","doi-asserted-by":"crossref","unstructured":"Barth, A.: The web origin concept (2011). http:\/\/tools.ietf.org\/html\/rfc6454","DOI":"10.17487\/rfc6454"},{"key":"29_CR4","doi-asserted-by":"crossref","unstructured":"Barth, A., Jackson, C., Mitchell, J.C.: Robust defenses for cross-site request forgery. In: Proceedings of the 15th ACM Conference on Computer and Communications Security, CCS 2008, pp. 75\u201388 (2008)","DOI":"10.1145\/1455770.1455782"},{"key":"29_CR5","doi-asserted-by":"crossref","unstructured":"Bau, J., Bursztein, E., Gupta, D., Mitchell, J.C.: State of the art: automated black-box web application vulnerability testing. In: 31st IEEE Symposium on Security and Privacy, S&P 2010, Berleley\/Oakland, California, USA, 16\u201319 May 2010, pp. 332\u2013345 (2010)","DOI":"10.1109\/SP.2010.27"},{"key":"29_CR6","unstructured":"Bortz, A., Barth, A., Czeskis, A.: Origin cookies: session integrity for web applications. In: Web 2.0 Security and Privacy Workshop (W2SP 2011) (2011)"},{"key":"29_CR7","doi-asserted-by":"crossref","unstructured":"B\u00fcchler, M., Oudinet, J., Pretschner, A.: SPaCiTE - web application testing engine. In: Fifth IEEE International Conference on Software Testing, Verification and Validation, ICST 2012, Montreal, QC, Canada, 17\u201321 April 2012, pp. 858\u2013859 (2012)","DOI":"10.1109\/ICST.2012.187"},{"issue":"4","key":"29_CR8","doi-asserted-by":"publisher","first-page":"509","DOI":"10.3233\/JCS-150529","volume":"23","author":"M Bugliesi","year":"2015","unstructured":"Bugliesi, M., Calzavara, S., Focardi, R., Khan, W.: CookiExt: patching the browser against session hijacking attacks. J. Comput. Secur. 23(4), 509\u2013537 (2015)","journal-title":"J. Comput. Secur."},{"key":"29_CR9","doi-asserted-by":"crossref","unstructured":"Bugliesi, M., Calzavara, S., Focardi, R., Khan, W., Tempesta, M.: Provably sound browser-based enforcement of web session integrity. In: Proceedings of the IEEE 27th Computer Security Foundations Symposium, CSF 2014, pp. 366\u2013380 (2014)","DOI":"10.1109\/CSF.2014.33"},{"key":"29_CR10","doi-asserted-by":"crossref","unstructured":"Calzavara, S., Conti, M., Focardi, R., Rabitti, A., Tolomei, G.: Mitch: a machine learning approach to the black-box detection of CSRF vulnerabilities. In: IEEE European Symposium on Security and Privacy (2019)","DOI":"10.1109\/EuroSP.2019.00045"},{"key":"29_CR11","doi-asserted-by":"crossref","unstructured":"Calzavara, S., Focardi, R., Grimm, N., Maffei, M.: Micro-policies for web session security. In: IEEE 29th Computer Security Foundations Symposium, CSF 2016, Lisbon, Portugal, 27 June\u20131 July 2016, pp. 179\u2013193 (2016)","DOI":"10.1109\/CSF.2016.20"},{"key":"29_CR12","doi-asserted-by":"crossref","unstructured":"Calzavara, S., Focardi, R., Nemec, M., Rabitti, A., Squarcina, M.: Postcards from the post-HTTP world: amplification of HTTPS vulnerabilities in the web ecosystem. In: IEEE Symposium on Security and Privacy (2019)","DOI":"10.1109\/SP.2019.00053"},{"key":"29_CR13","doi-asserted-by":"publisher","first-page":"13","DOI":"10.1145\/3038923","volume":"50","author":"S Calzavara","year":"2017","unstructured":"Calzavara, S., Focardi, R., Squarcina, M., Tempesta, M.: Surviving the web: a journey into web session security. ACM Comput. Surv. 50, 13 (2017)","journal-title":"ACM Comput. Surv."},{"issue":"2","key":"29_CR14","doi-asserted-by":"publisher","first-page":"233","DOI":"10.3233\/JCS-181149","volume":"27","author":"S Calzavara","year":"2019","unstructured":"Calzavara, S., Rabitti, A., Bugliesi, M.: Sub-session hijacking on the web: root causes and prevention. J. Comput. Secur. 27(2), 233\u2013257 (2019)","journal-title":"J. Comput. Secur."},{"issue":"3","key":"29_CR15","doi-asserted-by":"publisher","first-page":"15:1","DOI":"10.1145\/2754933","volume":"9","author":"S Calzavara","year":"2015","unstructured":"Calzavara, S., Tolomei, G., Casini, A., Bugliesi, M., Orlando, S.: A supervised learning approach to protect client authentication on the web. TWEB 9(3), 15:1\u201315:30 (2015)","journal-title":"TWEB"},{"issue":"1","key":"29_CR16","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/2220352.2220353","volume":"12","author":"I Dacosta","year":"2012","unstructured":"Dacosta, I., Chakradeo, S., Ahamad, M., Traynor, P.: One-time cookies: preventing session hijacking attacks with stateless authentication tokens. ACM Trans. Internet Technol. 12(1), 1\u201324 (2012)","journal-title":"ACM Trans. Internet Technol."},{"key":"29_CR17","unstructured":"Dietz, M., Czeskis, A., Balfanz, D., Wallach, D.S.: Origin-bound certificates: a fresh approach to strong client authentication for the web. In: Proceedings of the 21th USENIX Security Symposium, USENIX 2012, pp. 317\u2013331 (2012)"},{"key":"29_CR18","doi-asserted-by":"crossref","unstructured":"Hodges, J., Jackson, C., Barth, A.: HTTP Strict Transport Security (HSTS) (2012). http:\/\/tools.ietf.org\/html\/rfc6797","DOI":"10.17487\/rfc6797"},{"key":"29_CR19","doi-asserted-by":"crossref","unstructured":"Johns, M., Braun, B., Schrank, M., Posegga, J.: Reliable protection against session fixation attacks. In: Proceedings of the 26th ACM Symposium on Applied Computing, SAC 2011, pp. 1531\u20131537 (2011)","DOI":"10.1145\/1982185.1982511"},{"key":"29_CR20","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"89","DOI":"10.1007\/978-3-319-13841-1_6","volume-title":"Information Systems Security","author":"W Khan","year":"2014","unstructured":"Khan, W., Calzavara, S., Bugliesi, M., De Groef, W., Piessens, F.: Client side web session integrity as a non-interference property. In: Prakash, A., Shyamasundar, R. (eds.) ICISS 2014. LNCS, vol. 8880, pp. 89\u2013108. Springer, Cham (2014). https:\/\/doi.org\/10.1007\/978-3-319-13841-1_6"},{"key":"29_CR21","doi-asserted-by":"crossref","unstructured":"Kranch, M., Bonneau, J.: Upgrading HTTPS in mid-air: an empirical study of strict transport security and key pinning. In: 22nd Annual Network and Distributed System Security Symposium, NDSS 2015, San Diego, California, USA, 8\u201311 February 2015 (2015)","DOI":"10.14722\/ndss.2015.23162"},{"key":"29_CR22","unstructured":"Mozilla: Same-Origin Policy (2015). http:\/\/developer.mozilla.org\/en-US\/docs\/Web\/Security\/Same-origin_policy"},{"key":"29_CR23","doi-asserted-by":"crossref","unstructured":"Mundada, Y., Feamster, N., Krishnamurthy, B.: Half-baked cookies: hardening cookie-based authentication for the modern web. In: Proceedings of the 11th ACM on Asia Conference on Computer and Communications Security, AsiaCCS 2016, Xi\u2019an, China, 30 May\u20133 June 2016, pp. 675\u2013685 (2016)","DOI":"10.1145\/2897845.2897889"},{"key":"29_CR24","series-title":"Lecture Notes in Computer Science","doi-asserted-by":"publisher","first-page":"87","DOI":"10.1007\/978-3-642-19125-1_7","volume-title":"Engineering Secure Software and Systems","author":"N Nikiforakis","year":"2011","unstructured":"Nikiforakis, N., Meert, W., Younan, Y., Johns, M., Joosen, W.: SessionShield: lightweight protection against session hijacking. In: Erlingsson, \u00da., Wieringa, R., Zannone, N. (eds.) ESSoS 2011. LNCS, vol. 6542, pp. 87\u2013100. Springer, Heidelberg (2011). https:\/\/doi.org\/10.1007\/978-3-642-19125-1_7"},{"key":"29_CR25","unstructured":"OWASP: OWASP Testing Guide (2016). https:\/\/www.owasp.org\/index.php\/OWASP_Testing_Guide_v4_Table_of_Contents"},{"key":"29_CR26","doi-asserted-by":"crossref","unstructured":"Pellegrino, G., Johns, M., Koch, S., Backes, M., Rossow, C.: Deemon: detecting CSRF with dynamic analysis and property graphs. In: Proceedings of the 2017 ACM SIGSAC Conference on Computer and Communications Security, CCS 2017, Dallas, TX, USA, 30 October\u201303 November 2017, pp. 1757\u20131771 (2017)","DOI":"10.1145\/3133956.3133959"},{"issue":"8","key":"29_CR27","doi-asserted-by":"publisher","first-page":"e1685","DOI":"10.1002\/stvr.1685","volume":"28","author":"M Peroli","year":"2018","unstructured":"Peroli, M., Meo, F.D., Vigan\u00f2, L., Guardini, D.: MobSTer: a model-based security testing framework for web applications. Softw. Test. Verif. Reliab. 28(8), e1685 (2018)","journal-title":"Softw. Test. Verif. Reliab."},{"key":"29_CR28","series-title":"IFIP Advances in Information and Communication Technology","doi-asserted-by":"publisher","first-page":"30","DOI":"10.1007\/978-3-642-55415-5_3","volume-title":"ICT Systems Security and Privacy Protection","author":"M Rocchetto","year":"2014","unstructured":"Rocchetto, M., Ochoa, M., Torabi Dashti, M.: Model-based detection of CSRF. In: Cuppens-Boulahia, N., Cuppens, F., Jajodia, S., Abou El Kalam, A., Sans, T. (eds.) SEC 2014. IAICT, vol. 428, pp. 30\u201343. Springer, Heidelberg (2014). https:\/\/doi.org\/10.1007\/978-3-642-55415-5_3"},{"key":"29_CR29","doi-asserted-by":"crossref","unstructured":"Sivakorn, S., Polakis, I., Keromytis, A.D.: The cracked cookie jar: HTTP cookie hijacking and the exposure of private information. In: IEEE Symposium on Security and Privacy, SP 2016, San Jose, CA, USA, 22\u201326 May 2016, pp. 724\u2013742 (2016)","DOI":"10.1109\/SP.2016.49"},{"key":"29_CR30","doi-asserted-by":"crossref","unstructured":"Sudhodanan, A., Carbone, R., Compagna, L., Dolgin, N., Armando, A., Morelli, U.: Large-scale analysis & detection of authentication cross-site request forgeries. In: 2017 IEEE European Symposium on Security and Privacy, EuroS&P 2017, Paris, France, 26\u201328 April 2017, pp. 350\u2013365 (2017)","DOI":"10.1109\/EuroSP.2017.45"},{"key":"29_CR31","doi-asserted-by":"crossref","unstructured":"Tang, S., Dautenhahn, N., King, S.T.: Fortifying web-based applications automatically. In: Proceedings of the 18th ACM Conference on Computer and Communications Security, CCS 2011, pp. 615\u2013626 (2011)","DOI":"10.1145\/2046707.2046777"},{"key":"29_CR32","unstructured":"West, M.: Cookie prefixes (2016). https:\/\/tools.ietf.org\/html\/draft-ietf-httpbis-cookie-prefixes-00"},{"key":"29_CR33","unstructured":"West, M.: Strict secure cookies (2016). https:\/\/tools.ietf.org\/html\/draft-ietf-httpbis-cookie-alone-01"},{"key":"29_CR34","unstructured":"West, M., Goodwin, M.: Same-site cookies (2016). https:\/\/tools.ietf.org\/id\/draft-ietf-httpbis-cookie-same-site-00.txt"},{"key":"29_CR35","unstructured":"Zheng, X., et al.: Cookies lack integrity: real-world implications. In: Proceedings of the 24th USENIX Security Symposium, USENIX 2015, pp. 707\u2013721 (2015)"}],"container-title":["Lecture Notes in Computer Science","Computer Security \u2013 ESORICS 2019"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-030-29962-0_29","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,9,15]],"date-time":"2024-09-15T00:16:05Z","timestamp":1726359365000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-030-29962-0_29"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2019]]},"ISBN":["9783030299613","9783030299620"],"references-count":35,"URL":"https:\/\/doi.org\/10.1007\/978-3-030-29962-0_29","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"type":"print","value":"0302-9743"},{"type":"electronic","value":"1611-3349"}],"subject":[],"published":{"date-parts":[[2019]]},"assertion":[{"value":"15 September 2019","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"ESORICS","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"European Symposium on Research in Computer Security","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Luxembourg","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Luxembourg","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2019","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"23 September 2019","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"27 September 2019","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"24","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"esorics2019","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"http:\/\/conf.laas.fr\/esorics\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Single-blind","order":1,"name":"type","label":"Type","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"EasyChair","order":2,"name":"conference_management_system","label":"Conference Management System","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"344","order":3,"name":"number_of_submissions_sent_for_review","label":"Number of Submissions Sent for Review","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"67","order":4,"name":"number_of_full_papers_accepted","label":"Number of Full Papers Accepted","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"0","order":5,"name":"number_of_short_papers_accepted","label":"Number of Short Papers Accepted","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"19% - The value is computed by the equation \"Number of Full Papers Accepted \/ Number of Submissions Sent for Review * 100\" and then rounded to a whole number.","order":6,"name":"acceptance_rate_of_full_papers","label":"Acceptance Rate of Full Papers","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"3,2","order":7,"name":"average_number_of_reviews_per_paper","label":"Average Number of Reviews per Paper","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"11","order":8,"name":"average_number_of_papers_per_reviewer","label":"Average Number of Papers per Reviewer","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"Yes","order":9,"name":"external_reviewers_involved","label":"External Reviewers Involved","group":{"name":"ConfEventPeerReviewInformation","label":"Peer Review Information (provided by the conference organizers)"}},{"value":"This content has been made available to all.","name":"free","label":"Free to read"}]}}