{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,8]],"date-time":"2026-10-08T11:42:41Z","timestamp":1791459761350,"version":"4.3.4"},"publisher-location":"New York, NY, USA","reference-count":87,"publisher":"ACM","license":[{"start":{"date-parts":[[2024,7,1]],"date-time":"2024-07-01T00:00:00Z","timestamp":1719792000000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2024,7]]},"DOI":"10.1145\/3634737.3637678","type":"proceedings-article","created":{"date-parts":[[2024,6,28]],"date-time":"2024-06-28T11:51:38Z","timestamp":1719575498000},"page":"843-855","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":11,"title":["Who's Breaking the Rules? Studying Conformance to the HTTP Specifications and its Security Impact"],"prefix":"10.1145","author":[{"ORCID":"https:\/\/orcid.org\/0009-0002-4816-0428","authenticated-orcid":false,"given":"Jannis","family":"Rautenstrauch","sequence":"first","affiliation":[{"name":"CISPA Helmholtz Center for Information Security, Saarbr\u00fccken, Germany"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9659-0700","authenticated-orcid":false,"given":"Ben","family":"Stock","sequence":"additional","affiliation":[{"name":"CISPA Helmholtz Center for Information Security, Saarbr\u00fccken, Germany"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2024,7]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"[SW] 0ang3el 0ang3el\/Websocket-Smuggle 2019. url: https:\/\/github.com\/0ang3el\/websocket-smuggle."},{"key":"e_1_3_2_1_2_1","volume-title":"Martin Monperrus, Sylvain Gombault, Mario Heiderich, and Alain Ribault.","author":"Abgrall Erwan","year":"2012","unstructured":"Erwan Abgrall, Yves Le Traon, Martin Monperrus, Sylvain Gombault, Mario Heiderich, and Alain Ribault. 2012. XSS-FP: Browser Fingerprinting using HTML Parser Quirks. arXiv: 1211.4812 [cs]. preprint."},{"key":"e_1_3_2_1_3_1","volume-title":"Johnson","author":"Adamczyk Paul","year":"2008","unstructured":"Paul Adamczyk, Munawar Hafiz, and Ralph E. Johnson. 2008. Non-compliant and Proud: A Case Study of HTTP Compliance. https:\/\/hdl.handle.net\/2142\/11424."},{"key":"e_1_3_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1109\/spw54247.2022.9833883"},{"key":"e_1_3_2_1_5_1","doi-asserted-by":"publisher","unstructured":"Eric Allman. 2011. The Robustness Principle Reconsidered. ACM Queue. 10.1145\/1989748.1999945","DOI":"10.1145\/1989748.1999945"},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"publisher","unstructured":"Adam Barth. 2011. HTTP State Management Mechanism. Request for Comments RFC 6265. Internet Engineering Task Force. 10.17487\/RFC6265","DOI":"10.17487\/RFC6265"},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1109\/sp.2009.3"},{"key":"e_1_3_2_1_8_1","doi-asserted-by":"publisher","unstructured":"Mike Belshe Roberto Peon and Martin Thomson. 2015. Hypertext Transfer Protocol Version 2 (HTTP\/2). Request for Comments RFC 7540. Internet Engineering Task Force. 10.17487\/RFC7540","DOI":"10.17487\/RFC7540"},{"key":"e_1_3_2_1_9_1","unstructured":"Tim Berners-Lee. 1991. HTTP 0.9. https:\/\/www.w3.org\/Protocols\/HTTP\/AsImplemented.html."},{"key":"e_1_3_2_1_10_1","volume-title":"Information Management: A Proposal.","author":"Berners-Lee Timothy J","year":"1989","unstructured":"Timothy J Berners-Lee. 1989. Information Management: A Proposal."},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","unstructured":"Mike Bishop. 2022. HTTP\/3. Request for Comments RFC 9114. Internet Engineering Task Force. 10.17487\/RFC9114","DOI":"10.17487\/RFC9114"},{"key":"e_1_3_2_1_12_1","doi-asserted-by":"publisher","unstructured":"Scott O. Bradner. 1997. Key Words for Use in RFCs to Indicate Requirement Levels. Request for Comments RFC 2119. Internet Engineering Task Force. 10.17487\/RFC2119","DOI":"10.17487\/RFC2119"},{"key":"e_1_3_2_1_13_1","unstructured":"BuiltWith\u00ae. 2023. Root Authority Usage Distribution on the Entire Internet. https:\/\/trends.builtwith.com\/ssl\/root-authority\/traffic\/Entire-Internet."},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-78120-0_22"},{"key":"e_1_3_2_1_15_1","volume-title":"USENIX Security Symposium. https:\/\/www.usenix.org\/conference\/usenixsecurity20\/presentation\/calzavara.","author":"Calzavara Stefano","year":"2020","unstructured":"Stefano Calzavara, Sebastian Roth, Alvise Rabitti, Michael Backes, and Ben Stock. 2020. A Tale of Two Headers: A Formal Analysis of Inconsistent Click-Jacking Protection on the Web. In USENIX Security Symposium. https:\/\/www.usenix.org\/conference\/usenixsecurity20\/presentation\/calzavara."},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.17487\/RFC1958"},{"key":"e_1_3_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978394"},{"key":"e_1_3_2_1_18_1","unstructured":"MDN contributors. 2023. Evolution of HTTP. https:\/\/web.archive.org\/web\/20230821100712\/https:\/\/developer.mozilla.org\/en-US\/docs\/Web\/HTTP\/Basics_of_HTTP\/Evolution_of_HTTP."},{"key":"e_1_3_2_1_19_1","volume-title":"Mitmproxy: A Free and Open Source Interactive HTTPS Proxy version 7.0.2","author":"Cortesi Aldo","year":"2021","unstructured":"[SW] Aldo Cortesi, Maximilian Hils, Thomas Kriechbaumer, and contributors, Mitmproxy: A Free and Open Source Interactive HTTPS Proxy version 7.0.2, 2021. url: https:\/\/mitmproxy.org\/."},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"publisher","unstructured":"Dave Crocker and Paul Overell. 2008. Augmented BNF for Syntax Specifications: ABNF. Request for Comments RFC 5234. Internet Engineering Task Force. 10.17487\/RFC5234","DOI":"10.17487\/RFC5234"},{"key":"e_1_3_2_1_21_1","volume-title":"Response Smuggling: Pwning HTTP\/1.1 Connections. HITB+ CyberWeek","author":"Doyhenard Martin","year":"2021","unstructured":"Martin Doyhenard. 2021. Response Smuggling: Pwning HTTP\/1.1 Connections. HITB+ CyberWeek 2021. https:\/\/cyberweek.ae\/2021\/presentations\/response-smuggling-pwning-http-1-1-connections\/."},{"key":"e_1_3_2_1_22_1","unstructured":"Zakir Durumeric. 2023. Zakird\/crux-top-lists: Downloadable snapshots of the Chrome Top Million Websites pulled from public CrUX data in BigQuery. https:\/\/github.com\/zakird\/crux-top-lists."},{"key":"e_1_3_2_1_23_1","volume-title":"HTTPX","year":"2023","unstructured":"[SW] Encode, HTTPX 2023. url: https:\/\/www.python-httpx.org\/."},{"key":"e_1_3_2_1_24_1","unstructured":"Let's Encrypt. 2023. Let's Encrypt Stats. https:\/\/letsencrypt.org\/stats\/."},{"key":"e_1_3_2_1_25_1","volume-title":"Measuring HTTPS Adoption on the Web. In USENIX Security Symposium. https:\/\/www.usenix.org\/conference\/usenixsecurity17\/technical-sessions\/presentation\/felt.","author":"Felt Adrienne Porter","year":"2017","unstructured":"Adrienne Porter Felt, Richard Barnes, April King, Chris Palmer, Chris Bentzel, and Parisa Tabriz. 2017. Measuring HTTPS Adoption on the Web. In USENIX Security Symposium. https:\/\/www.usenix.org\/conference\/usenixsecurity17\/technical-sessions\/presentation\/felt."},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.17487\/RFC2068"},{"key":"e_1_3_2_1_27_1","doi-asserted-by":"publisher","unstructured":"Roy T. Fielding Mark Nottingham and Julian Reschke. 2022. HTTP Semantics. Request for Comments RFC 9110. Internet Engineering Task Force. 10.17487\/RFC9110","DOI":"10.17487\/RFC9110"},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"publisher","unstructured":"Roy T. Fielding Mark Nottingham and Julian Reschke. 2022. HTTP Semantics. Official Internet Protocol Standards STD 97. Internet Engineering Task Force. 10.17487\/RFC9110","DOI":"10.17487\/RFC9110"},{"key":"e_1_3_2_1_29_1","doi-asserted-by":"publisher","unstructured":"Roy T. Fielding Mark Nottingham and Julian Reschke. 2022. HTTP\/1.1. Request for Comments RFC 9112. Internet Engineering Task Force. 10.17487\/RFC9112","DOI":"10.17487\/RFC9112"},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.17487\/RFC7230"},{"key":"e_1_3_2_1_31_1","volume-title":"Apache HTTP Server","author":"Foundation Apache Software","year":"2023","unstructured":"[SW] Apache Software Foundation, Apache HTTP Server 2023. url: https:\/\/github.com\/apache\/httpd."},{"key":"e_1_3_2_1_32_1","unstructured":"[SW] OpenJS Foundation Node.Js 2023. url: https:\/\/github.com\/nodejs\/node\/tree\/main."},{"key":"e_1_3_2_1_33_1","volume-title":"USENIX Security Symposium. https:\/\/www.usenix.org\/conference\/usenixsecurity23\/presentation\/franken.","author":"Franken Gertjan","year":"2023","unstructured":"Gertjan Franken, Tom Van Goethem, Lieven Desmet, and Wouter Joosen. 2023. A Bug's Life: Analyzing the Lifecycle and Mitigation Process of Content Security Policy Bugs. In USENIX Security Symposium. https:\/\/www.usenix.org\/conference\/usenixsecurity23\/presentation\/franken."},{"key":"e_1_3_2_1_34_1","volume-title":"USENIX Security Symposium. https:\/\/www.usenix.org\/conference\/usenixsecurity23\/presentation\/gierlings.","author":"Gierlings Matthias","year":"2023","unstructured":"Matthias Gierlings, Marcus Brinkmann, and J\u00f6rg Schwenk. 2023. Isolated and Exhausted: Attacking Operating Systems via Site Isolation in the Browser. In USENIX Security Symposium. https:\/\/www.usenix.org\/conference\/usenixsecurity23\/presentation\/gierlings."},{"key":"e_1_3_2_1_35_1","unstructured":"Google. 2023. Chrome Platform Status. https:\/\/chromestatus.com\/metrics\/feature\/popularity."},{"key":"e_1_3_2_1_36_1","unstructured":"Google. 2014. HTTPS as a ranking signal. Google for Developers. https:\/\/developers.google.com\/search\/blog\/2014\/08\/https-as-ranking-signal."},{"key":"e_1_3_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1109\/edoc52215.2021.00028"},{"key":"e_1_3_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1145\/3517745.3561437"},{"key":"e_1_3_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.1145\/2508859.2516723"},{"key":"e_1_3_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.1145\/2771783.2771789"},{"key":"e_1_3_2_1_41_1","volume-title":"USENIX Security Symposium. https:\/\/www.usenix.org\/conference\/usenixsecurity22\/presentation\/jabiyev.","author":"Jabiyev Bahruz","year":"2022","unstructured":"Bahruz Jabiyev, Steven Sprecher, Anthony Gavazzi, Tommaso Innocenti, Kaan Onarlioglu, and Engin Kirda. 2022. FRAMESHIFTER: Security Implications of HTTP\/2-to-HTTP\/1 Conversion Anomalies. In USENIX Security Symposium. https:\/\/www.usenix.org\/conference\/usenixsecurity22\/presentation\/jabiyev."},{"key":"e_1_3_2_1_42_1","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3485384"},{"key":"e_1_3_2_1_43_1","doi-asserted-by":"publisher","DOI":"10.1145\/3442381.3450050"},{"key":"e_1_3_2_1_44_1","unstructured":"James Kettle. 2019. HTTP Desync Attacks: Request Smuggling Reborn. PortSwigger Research. https:\/\/portswigger.net\/research\/http-desync-attacks-request-smuggling-reborn."},{"key":"e_1_3_2_1_45_1","volume-title":"USENIX Security Symposium. https:\/\/www.usenix.org\/conference\/usenixsecurity22\/presentation\/kim.","author":"Kim Sunwoo","year":"2022","unstructured":"Sunwoo Kim, Young Min Kim, Jaewon Hur, Suhwan Song, Gwangmu Lee, and Byoungyoung Lee. 2022. {FuzzOrigin}: Detecting {UXSS} vulnerabilities in Browsers through Origin Fuzzing. In USENIX Security Symposium. https:\/\/www.usenix.org\/conference\/usenixsecurity22\/presentation\/kim."},{"key":"e_1_3_2_1_46_1","doi-asserted-by":"publisher","DOI":"10.1145\/3460120.3484739"},{"key":"e_1_3_2_1_47_1","doi-asserted-by":"publisher","unstructured":"Mike Kosek Leo Bl\u00f6cher Jan R\u00fcth Torsten Zimmermann and Oliver Hohlfeld. 2020. MUST SHOULD DON'T CARE: TCP Conformance in the Wild. In Passive and Active Measurement. 10.1007\/978-3-030-44081-7_8","DOI":"10.1007\/978-3-030-44081-7_8"},{"key":"e_1_3_2_1_48_1","unstructured":"Balachander Krishnamurthy Martin Arlitt T Labs Hewlett-Packard Laboratories Park Avenue and Florham Park. 2001. PRO-COW: Protocol Compliance on the Web-A Longitudinal Study. In USITS. https:\/\/www.usenix.org\/conference\/usits-01\/pro-cow-protocol-compliance-web%E2%80%93-longitudinal-study."},{"key":"e_1_3_2_1_49_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2019.23149"},{"key":"e_1_3_2_1_50_1","volume-title":"Web Cache Deception Escalates. In USENIX Security Symposium. https:\/\/www.usenix.org\/conference\/usenixsecurity22\/presentation\/mirheidari.","author":"Mirheidari Seyed Ali","year":"2022","unstructured":"Seyed Ali Mirheidari, Matteo Golinelli, Kaan Onarlioglu, Engin Kirda, and Bruno Crispo. 2022. Web Cache Deception Escalates. In USENIX Security Symposium. https:\/\/www.usenix.org\/conference\/usenixsecurity22\/presentation\/mirheidari."},{"key":"e_1_3_2_1_51_1","doi-asserted-by":"publisher","DOI":"10.1145\/3297280.3297526"},{"key":"e_1_3_2_1_52_1","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3354215"},{"key":"e_1_3_2_1_53_1","doi-asserted-by":"publisher","DOI":"10.1145\/3240431.3240443"},{"key":"e_1_3_2_1_54_1","doi-asserted-by":"publisher","DOI":"10.17487\/RFC1945"},{"key":"e_1_3_2_1_55_1","doi-asserted-by":"publisher","unstructured":"Henrik Nielsen Jeffrey Mogul Larry M. Masinter Roy T. Fielding Jim Gettys Paul J. Leach and Tim Berners-Lee. 1999. Hypertext Transfer Protocol - HTTP\/1.1. Request for Comments RFC 2616. Internet Engineering Task Force. 10.17487\/RFC2616","DOI":"10.17487\/RFC2616"},{"key":"e_1_3_2_1_56_1","unstructured":"Mark Nottingham. 2023. REDbot. https:\/\/redbot.org\/."},{"key":"e_1_3_2_1_57_1","doi-asserted-by":"publisher","unstructured":"Jon Postel. 1980. DoD Standard Transmission Control Protocol. Request for Comments RFC 761. Internet Engineering Task Force. 10.17487\/RFC0761","DOI":"10.17487\/RFC0761"},{"key":"e_1_3_2_1_58_1","doi-asserted-by":"publisher","unstructured":"Jon Postel. 1981. Transmission Control Protocol. Request for Comments RFC 793. Internet Engineering Task Force. 10.17487\/RFC0793","DOI":"10.17487\/RFC0793"},{"key":"e_1_3_2_1_59_1","doi-asserted-by":"publisher","DOI":"10.1109\/sp46215.2023.10179311"},{"key":"e_1_3_2_1_60_1","volume-title":"HTTP Conformance Checker","author":"Rautenstrauch Jannis","year":"2023","unstructured":"[SW] Jannis Rautenstrauch and Ben Stock, HTTP Conformance Checker 2023. url: https:\/\/github.com\/cispa\/http-conformance."},{"key":"e_1_3_2_1_61_1","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2020.23046"},{"key":"e_1_3_2_1_62_1","volume-title":"The Security Lottery: Measuring Client-Side Web Security Inconsistencies. In USENIX Security Symposium. https:\/\/www.usenix.org\/conference\/usenixsecurity22\/presentation\/roth.","author":"Roth Sebastian","year":"2022","unstructured":"Sebastian Roth, Stefano Calzavara, Moritz Wilhelm, Alvise Rabitti, and Ben Stock. 2022. The Security Lottery: Measuring Client-Side Web Security Inconsistencies. In USENIX Security Symposium. https:\/\/www.usenix.org\/conference\/usenixsecurity22\/presentation\/roth."},{"key":"e_1_3_2_1_63_1","unstructured":"Vaspol Ruamviboonsuk. 2022. The 2022 Web Almanac: HTTP. 23. HTTP Archive. https:\/\/almanac.httparchive.org\/en\/2022\/http."},{"key":"e_1_3_2_1_64_1","doi-asserted-by":"publisher","DOI":"10.1109\/msp.2012.31"},{"key":"e_1_3_2_1_65_1","doi-asserted-by":"publisher","DOI":"10.1109\/dsn53405.2022.00014"},{"key":"e_1_3_2_1_66_1","doi-asserted-by":"publisher","DOI":"10.1109\/spw54247.2022.9833880"},{"key":"e_1_3_2_1_67_1","unstructured":"Snyk. 2022. URL confusion vulnerabilities in the wild: Exploring parser inconsistencies. Snyk. https:\/\/snyk.io\/blog\/url-confusion-vulnerabilities\/."},{"key":"e_1_3_2_1_68_1","volume-title":"Cookie Crumbles: Breaking and Fixing Web Session Integrity. In USENIX Security Symposium. https:\/\/www.usenix.org\/conference\/usenixsecurity23\/presentation\/squarcina.","author":"Squarcina Marco","year":"2023","unstructured":"Marco Squarcina, Pedro Ad\u00e3o, Lorenzo Veronese, and Matteo Maffei. 2023. Cookie Crumbles: Breaking and Fixing Web Session Integrity. In USENIX Security Symposium. https:\/\/www.usenix.org\/conference\/usenixsecurity23\/presentation\/squarcina."},{"key":"e_1_3_2_1_69_1","unstructured":"Web Tech Survey. 2023. Website technology checker. Web Technology Survey. https:\/\/webtechsurvey.com\/."},{"key":"e_1_3_2_1_70_1","unstructured":"The Measurement Factory. 2018. Co-Advisor. https:\/\/web.archive.org\/web\/20211202131011\/http:\/\/coad.measurement-factory.com\/."},{"key":"e_1_3_2_1_71_1","unstructured":"The Measurement Factory. 2001. HTTP Compliance and W3C QA. https:\/\/www.w3.org\/2001\/01\/qa-ws\/pp\/alex-rousskov-measfact.html."},{"key":"e_1_3_2_1_72_1","doi-asserted-by":"publisher","unstructured":"Martin Thomson and Cory Benfield. 2022. HTTP\/2. Request for Comments RFC 9113. Internet Engineering Task Force. 10.17487\/RFC9113","DOI":"10.17487\/RFC9113"},{"key":"e_1_3_2_1_73_1","doi-asserted-by":"publisher","unstructured":"Martin Thomson and David Schinazi. 2023. Maintaining Robust Protocols. Request for Comments RFC 9413. Internet Engineering Task Force. 10.17487\/RFC9413","DOI":"10.17487\/RFC9413"},{"key":"e_1_3_2_1_74_1","unstructured":"W3C. 2023. Content Security Policy Level 3. Working Draft. https:\/\/www.w3.org\/TR\/2023\/WD-CSP3-20230220\/."},{"key":"e_1_3_2_1_75_1","volume-title":"Upgrade Insecure Requests. Editor","author":"C.","unstructured":"W3C. 2022. Upgrade Insecure Requests. Editor's Draft. https:\/\/w3c.github.io\/webappsec-upgrade-insecure-requests\/."},{"key":"e_1_3_2_1_76_1","unstructured":"W3C. 2012. UriTesting. https:\/\/www.w3.org\/wiki\/UriTesting."},{"key":"e_1_3_2_1_77_1","volume-title":"May","year":"2023","unstructured":"W3Techs. 2023. Usage Statistics and Market Share of Web Servers, May 2023. https:\/\/w3techs.com\/technologies\/overview\/web_server."},{"key":"e_1_3_2_1_78_1","unstructured":"Lukas Weichselbaum and Michele Spagnuolo. CSP-A Successful Mess Between Hardening and Mitigation. (2020). https:\/\/static.sched.com\/hosted_files\/locomocosec2019\/db\/CSP%20-%20A%20Successful%20Mess%20Between%20Hardening%20and%20Mitigation%20(1).pdf."},{"key":"e_1_3_2_1_79_1","doi-asserted-by":"publisher","DOI":"10.1145\/2976749.2978363"},{"key":"e_1_3_2_1_80_1","unstructured":"WHATWG. 2023. Fetch Standard. https:\/\/fetch.spec.whatwg.org\/commit-snapshots\/8f109835dcff90d19caed4b551a0da32d9d0f57e\/."},{"key":"e_1_3_2_1_81_1","unstructured":"WHATWG. 2023. HTML Standard. https:\/\/html.spec.whatwg.org\/commit-snapshots\/578def68a9735a1e36610a6789245ddfc13d24e0\/."},{"key":"e_1_3_2_1_82_1","unstructured":"WHATWG. 2023. MIME Sniffing Standard. https:\/\/mimesniff.spec.whatwg.org\/."},{"key":"e_1_3_2_1_83_1","volume-title":"Network and Distributed System Security Symposium. https:\/\/www.ndss-symposium.org\/wp-content\/uploads\/2023\/02\/ndss2023_f200_paper.pdf.","author":"Wi Seongil","year":"2023","unstructured":"Seongil Wi, Trung Tin Nguyen, Jiwhan Kim, Ben Stock, and Sooel Son. 2023. DiffCSP: Finding Browser Bugs in Content Security Policy Enforcement through Differential Testing. In Network and Distributed System Security Symposium. https:\/\/www.ndss-symposium.org\/wp-content\/uploads\/2023\/02\/ndss2023_f200_paper.pdf."},{"key":"e_1_3_2_1_84_1","unstructured":"WPT. 2023. Web-platform-tests documentation. https:\/\/web-platform-tests.org\/."},{"key":"e_1_3_2_1_85_1","volume-title":"Wptserve: Web Platform Test Server --- web-platform-tests documentation. https:\/\/web-platform-tests.org\/tools\/wptserve\/docs\/.","author":"WPT.","year":"2023","unstructured":"WPT. 2023. Wptserve: Web Platform Test Server --- web-platform-tests documentation. https:\/\/web-platform-tests.org\/tools\/wptserve\/docs\/."},{"key":"e_1_3_2_1_86_1","unstructured":"Yuchen Wu and Andrew Hauck. 2022. How we built Pingora the proxy that connects Cloudflare to the Internet. The Cloudflare Blog. http:\/\/blog.cloudflare.com\/how-we-built-pingora-the-proxy-that-connects-cloudflare-to-the-internet\/."},{"key":"e_1_3_2_1_87_1","unstructured":"Michal Zalewski. 2011. The Tangled Web: A Guide to Securing Modern Web Applications."}],"event":{"name":"ASIA CCS '24: 19th ACM Asia Conference on Computer and Communications Security","location":"Singapore Singapore","acronym":"ASIA CCS '24","sponsor":["SIGSAC ACM Special Interest Group on Security, Audit, and Control"]},"container-title":["Proceedings of the 19th ACM Asia Conference on Computer and Communications Security"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3634737.3637678","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T23:44:06Z","timestamp":1750290246000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3634737.3637678"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,7]]},"references-count":87,"alternative-id":["10.1145\/3634737.3637678","10.1145\/3634737"],"URL":"https:\/\/doi.org\/10.1145\/3634737.3637678","relation":{},"subject":[],"published":{"date-parts":[[2024,7]]},"assertion":[{"value":"2024-07-01","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}