{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T04:35:54Z","timestamp":1750221354832,"version":"3.41.0"},"publisher-location":"New York, New York, USA","reference-count":21,"publisher":"ACM Press","license":[{"start":{"date-parts":[[2018,1,1]],"date-time":"2018-01-01T00:00:00Z","timestamp":1514764800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2018]]},"DOI":"10.1145\/3184558.3186232","type":"proceedings-article","created":{"date-parts":[[2018,4,18]],"date-time":"2018-04-18T18:04:25Z","timestamp":1524074665000},"page":"451-455","source":"Crossref","is-referenced-by-count":4,"title":["Surviving the Web"],"prefix":"10.1145","author":[{"given":"Stefano","family":"Calzavara","sequence":"first","affiliation":[{"name":"Universit\u00e0 Ca Foscari Venezia, Venezia, Italy"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Riccardo","family":"Focardi","sequence":"additional","affiliation":[{"name":"Universit\u00e0 Ca Foscari Venezia, Venezia, Italy"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Marco","family":"Squarcina","sequence":"additional","affiliation":[{"name":"Universit\u00e0 Ca Foscari Venezia, Venezia, Italy"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Mauro","family":"Tempesta","sequence":"additional","affiliation":[{"name":"Universit\u00e0 Ca Foscari Venezia, Venezia, Italy"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","reference":[{"key":"key-10.1145\/3184558.3186232-1","doi-asserted-by":"crossref","unstructured":"Devdatta Akhawe, Adam Barth, Peifung E. Lam, John C. Mitchell, and Dawn Song. 2010. Towards a Formal Foundation of Web Security. In Proceedings of the 23rd IEEE Computer Security Foundations Symposium, CSF 2010. 290--304.","DOI":"10.1109\/CSF.2010.27"},{"key":"key-10.1145\/3184558.3186232-2","unstructured":"Chetan Bansal, Karthikeyan Bhargavan, Antoine Delignat-Lavaud, and Sergio Maffeis. 2013. Keys to the Cloud: Formal Analysis and Concrete Attacks on Encrypted Web Storage Proceedings of the 2nd International Conference on Principles of Security and Trust, POST 2013. 126--146."},{"key":"key-10.1145\/3184558.3186232-3","doi-asserted-by":"crossref","unstructured":"Adam Barth. 2011. HTTP State Management Mechanism. http:\/\/tools.ietf.org\/html\/rfc6265. (2011).","DOI":"10.17487\/rfc6265"},{"key":"key-10.1145\/3184558.3186232-4","unstructured":"Aaron Bohannon and Benjamin C. Pierce. 2010. Featherweight Firefox: Formalizing the Core of a Web Browser USENIX Conference on Web Application Development, WebApps 2010."},{"key":"key-10.1145\/3184558.3186232-5","unstructured":"Andrew Bortz, Adam Barth, and Alexei Czeskis. 2011. Origin Cookies: Session Integrity for Web Applications Web 2.0 Security & Privacy Workshop (W2SP 2011)."},{"key":"key-10.1145\/3184558.3186232-6","doi-asserted-by":"crossref","unstructured":"Michele Bugliesi, Stefano Calzavara, and Riccardo Focardi. 2017. Formal methods for web security. Journal of Logical and Algebraic Methods in Programming Vol. 87 (2017), 110--126.","DOI":"10.1016\/j.jlamp.2016.08.006"},{"key":"key-10.1145\/3184558.3186232-7","unstructured":"Michele Bugliesi, Stefano Calzavara, Riccardo Focardi, Wilayat Khan, and Mauro Tempesta. 2014. Provably Sound Browser-Based Enforcement of Web Session Integrity Proceedings of the IEEE 27th Computer Security Foundations Symposium, CSF 2014. 366--380."},{"key":"key-10.1145\/3184558.3186232-8","doi-asserted-by":"crossref","unstructured":"Stefano Calzavara, Riccardo Focardi, Marco Squarcina, and Mauro Tempesta. 2017. Surviving the Web: A Journey into Web Session Security. ACM Comput. Surv. Vol. 50, 1 (2017), 13:1--13:34.","DOI":"10.1145\/3038923"},{"key":"key-10.1145\/3184558.3186232-9","unstructured":"Stefano Calzavara, Alvise Rabitti, and Michele Bugliesi. 2016. Content Security Problems Evaluating the Effectiveness of Content Security Policy in the Wild. In Proceedings of the 23rd ACM Conference on Computer and Communications Security, CCS 2016. 1365--1375."},{"key":"key-10.1145\/3184558.3186232-10","unstructured":"Daniel Fett, Ralf Küsters, and Guido Schmitz. 2014. An Expressive Model for the Web Infrastructure: Definition and Application to the Browser ID SSO System. In Proceedings of the 35th IEEE Symposium on Security and Privacy, S&P 2014. 673--688."},{"key":"key-10.1145\/3184558.3186232-11","doi-asserted-by":"crossref","unstructured":"Willem De Groef, Dominique Devriese, Nick Nikiforakis, and Frank Piessens. 2012. FlowFox: a Web Browser with Flexible and Precise Information Flow Control Proceedings of the 19th ACM Conference on Computer and Communications Security, CCS 2012. 748--759.","DOI":"10.1145\/2382196.2382275"},{"key":"key-10.1145\/3184558.3186232-12","doi-asserted-by":"crossref","unstructured":"Norman Hardy. 1988. The Confused Deputy (or why capabilities might have been invented). Operating Systems Review Vol. 22, 4 (1988), 36--38.","DOI":"10.1145\/54289.871709"},{"key":"key-10.1145\/3184558.3186232-13","doi-asserted-by":"crossref","unstructured":"Mario Heiderich, Marcus Niemietz, Felix Schuster, Thorsten Holz, and Jörg Schwenk. 2012. Scriptless Attacks: Stealing the Pie Without Touching the Sill Proceedings of the 19th ACM Conference on Computer and Communications Security, CCS 2012. 760--771.","DOI":"10.1145\/2382196.2382276"},{"key":"key-10.1145\/3184558.3186232-14","unstructured":"OWASP. 2013. Top 10 Security Threats. https:\/\/www.owasp.org\/index.php\/Top_10_2013-Top_10. (2013)."},{"key":"key-10.1145\/3184558.3186232-15","doi-asserted-by":"crossref","unstructured":"Mary Frances Theofanos and Shari Lawrence Pfleeger. 2011. Guest Editors' Introduction: Shouldn't All Security Be Usable IEEE Security & Privacy Vol. 9, 2 (2011), 12--17.","DOI":"10.1109\/MSP.2011.30"},{"key":"key-10.1145\/3184558.3186232-16","unstructured":"W3C. 2012. Content Security Policy. http:\/\/www.w3.org\/TR\/CSP\/. (2012)."},{"key":"key-10.1145\/3184558.3186232-17","unstructured":"W3C. 2015. Content Security Policy Level 2. https:\/\/www.w3.org\/TR\/CSP2\/. (2015)."},{"key":"key-10.1145\/3184558.3186232-18","unstructured":"Joel Weinberger, Adam Barth, and Dawn Song. 2011. Towards Client-side HTML Security Policies. In 6th USENIX Workshop on Hot Topics in Security, HotSec 2011."},{"key":"key-10.1145\/3184558.3186232-19","unstructured":"Michael Weissbacher, Tobias Lauinger, and William K. Robertson. 2014. Why Is CSP Failing Trends and Challenges in CSP Adoption Proceedings of the 17th International Symposium on Research in Attacks, Intrusions and Defenses, RAID 2014. 212--233."},{"key":"key-10.1145\/3184558.3186232-20","unstructured":"Michal Zalewski. 2011. Postcards From the Post-XSS World. (2011). http:\/\/lcamtuf.coredump.cx\/postxss\/"},{"key":"key-10.1145\/3184558.3186232-21","unstructured":"Yuchen Zhou and David Evans. 2010. Why Aren't HTTP-only Cookies More Widely Deployed Web 2.0 Security and Privacy Workshop, W2SP 2010."}],"event":{"number":"2018","sponsor":["IW3C2, International World Wide Web Conference Committee","SIGWEB, ACM Special Interest Group on Hypertext, Hypermedia, and Web"],"acronym":"WWW '18","name":"Companion of the The Web Conference 2018","start":{"date-parts":[[2018,4,23]]},"location":"Lyon, France","end":{"date-parts":[[2018,4,27]]}},"container-title":["Companion of the The Web Conference 2018 on The Web Conference 2018 - WWW '18"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3184558.3186232","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"http:\/\/dl.acm.org\/ft_gateway.cfm?id=3186232&ftid=1958247&dwn=1","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T02:26:06Z","timestamp":1750213566000},"score":1,"resource":{"primary":{"URL":"http:\/\/dl.acm.org\/citation.cfm?doid=3184558.3186232"}},"subtitle":["A Journey into Web Session Security"],"proceedings-subject":"The Web Conference 2018","short-title":[],"issued":{"date-parts":[[2018]]},"references-count":21,"URL":"https:\/\/doi.org\/10.1145\/3184558.3186232","relation":{},"subject":[],"published":{"date-parts":[[2018]]}}}