Volltext-Downloads (blau) und Frontdoor-Views (grau)

Less is Often More: Header Whitelisting as Semantic Gap Mitigation in HTTP-Based Software Systems

  • The web is the most wide-spread digital system in the world and is used for many crucial applications. This makes web application security extremely important and, although there are already many security measures, new vulnerabilities are constantly being discovered. One reason for some of the recent discoveries lies in the presence of intermediate systems—e.g. caches, message routers, and load balancers—on the way between a client and a web application server. The implementations of such intermediaries may interpret HTTP messages differently, which leads to a semantically different understanding of the same message. This so-called semantic gap can cause weaknesses in the entire HTTP message processing chain. In this paper we introduce the header whitelisting (HWL) approach to address the semantic gap in HTTP message processing pipelines. The basic idea is to normalize and reduce an HTTP request header to the minimum required fields using a whitelist before processing it in an intermediary or on the server, and then restore the original request for the next hop. Our results show that HWL can avoid misinterpretations of HTTP messages in the different components and thus prevent many attacks rooted in a semantic gap including request smuggling, cache poisoning, and authentication bypass.

Download full text files

Export metadata

Additional Services

Share in Twitter Search Google Scholar Check availability

Statistics

Show usage statistics
Metadaten
Document Type:Conference Object
Language:English
Author:Andre BüttnerORCiD, Hoai Viet NguyenORCiD, Nils GruschkaORCiD, Luigi Lo IaconoORCiD
Parent Title (English):Jøsang, Futcher et al. (Eds.): ICT Systems Security and Privacy Protection. SEC 2021. IFIP Advances in Information and Communication Technology, Vol 625
Pagenumber:16
First Page:332
Last Page:347
ISBN:978-3-030-78119-4
URN:urn:nbn:de:hbz:1044-opus-55491
DOI:https://doi.org/10.1007/978-3-030-78120-0_22
Publisher:Springer
Place of publication:Cham
Publishing Institution:Hochschule Bonn-Rhein-Sieg
Date of first publication:2021/06/22
Note:
© IFIP International Federation for Information Processing 2021
Keyword:HTTP; Header whitelisting; Intermediaries; Semantic gap; Web; security
Departments, institutes and facilities:Fachbereich Informatik
Institut für Cyber Security & Privacy (ICSP)
Dewey Decimal Classification (DDC):0 Informatik, Informationswissenschaft, allgemeine Werke / 00 Informatik, Wissen, Systeme / 005 Computerprogrammierung, Programme, Daten
Entry in this database:2021/06/19
Licence (Multiple Languages):License LogoIn Copyright (Urheberrechtsschutz)