27 December 2011

Guide to HTML5 Web Security

Further to my previous notes about HTML 5 security, a superb reference document was published earlier this month.

An extract from a page in Michael Schmidt's document HTML5 Web Security showing how HTML5 vulnerabilities and attacks are described and illustrated in diagrammatic form

Michael Schmidt (Compass Security) wrote his master's thesis about HTML5 security in May 2011 and has published an extract for everyone to access.

HTML5 Web Security describes issues, vulnerabilities, threat & attack scenarios and countermeasures across 80 pages including numerous well thought-out diagrams, and is backed up with detailed references and an appendix full of attack details.

The main sections are:

2.2 Cross-origin resource sharing
2.3 Web storage
2.4 Offline web application
2.5 Web messaging
2.6 Custom scheme and content handlers
2.7 Web sockets API
2.8 Geolocation API
2.9 Implicit relevant features of HTML5
Web workers, new elements, attributes and CSS, Iframe sandboxing and server-sent events

If you are already developing HTML, or planning to, read this document as soon as possible and update your requirements documents, specifications, design documents, coding standards, and test plans to incorporate the knowledge.

The document would be worth buying if it were a book, but it has generously been made available publicly. Yes, I am still reading the document, and so far have only one very minor complaint — it would be good to have a content list. Maybe in version 1.1?

Posted on: 27 December 2011 at 09:07 hrs

Comments (4) | Permalink | Send | Post to Twitter

Comments

Comments are filtered automatically and should appear shortly after they been checked.

This is great!

1 Added by myname Posted on 27 December 2011 at 15:12 hrs

I appreciate Michael Schmidt for writing such informative notes. About guide to HTML5 whatever he wrote seems to me informative and instructive as well. I noted this document for my personal use. Thanks

2 Added by Andrew symonds Posted on 28 December 2011 at 08:19 hrs

I always like your blog post because you always comes with different ideas and information. I always shared your site post with my friends. Keep posting and i will follow you.

3 Added by Web Security Posted on 19 January 2012 at 05:36 hrs

This looks absolutely perfect. All these tinny details are made with lot of background knowledge. I like it a lot. This was a useful post and I think it is rather easy to see from the other comments as well that this post is well written and useful.

4 Added by health vitamins Posted on 08 February 2012 at 07:42 hrs