On the Systematic Design of Web Languages DENNIS VOLPANO Computer Science Department, Naval Postgraduate School, Monterey, CA volpano@cs.nps.navy.mil GEOFFREY SMITH School of Computer Science, Florida International University, Miami, FL smithg@fiu.edu Semanticists should be the obstetricians, not the coroners, of programming languages. John Reynolds Recently there has been phenomenal growth in the use of the Internet through the World-Wide Web. Especially interesting is the emergence of so-called Web languages, such as Java1 [Gosling and McGilton 1995; van Hoff et al. 1995], that support the development of programs that can be downloaded to a client s machine for execution by a Web browser. This brings power and flexibility to Web applications, but it also brings well-known endpoint security problems, such as the threat of integrity and unauthorized disclosure attacks [Bank 1995]. Yet, although security has been an issue in Web language design, there appears to be no formal characterization of the kinds of security properties one can expect of programs written in these languages. A Web language should, we believe, be designed so that all programs are guaranteed to satisfy explicitly stated security properties. To this end, we advocate a more systematic approach to the design of secure Web
/lp/association-for-computing-machinery/on-the-systematic-design-of-web-languages-azBRweumaI