Although traditional firewalls have effectively prevented network-level attacks, most future attacks will be at the application level, where current security mechanisms are woefully inadequate. Application-level security vulnerabilities are inherent in a Web application’s code, regardless of the technology in which the application is implemented or the security of the Web server and backend database on which it is built. A recent advisory published by Internet Security Systems (see the “Internet Resources” sidebar, p. 44) claims that 11 widely deployed shopping cart applications are vulnerable to a simple attack that lets hackers pur- chase goods for much less than their listed price. Worryingly, the attack does not require particular technical skill; it suffices to save the shopping cart’s HTML confirmation form to disk, use a text editor to modify the price of the goods (stored in a hidden form field), and load the HTML form back into the browser.

Application-level security vulnerabilities are well known, and many articles discuss ways to avoid them. Fixing a single occurrence of a vulnerability is usually easy. However, the massive number of interactions between different components of a dynamic Web site makes application-level security challenging in general. Despite numerous efforts to tighten application-level security through code review and other software engineering practices, many professionally designed Web sites still suffer from serious application-level security holes. This evidence suggests a need for higher-level tools and techniques to address the problem.

Traditionally, the task of preventing unauthorized activity at the application protocol level has been left to network firewalls. Many companies provide application-level firewalls as commercial products. Typical services provided by such firewalls include virus protection and access control. However, we are not aware of any application-level firewalls that are flexible enough to apply fine grained user-specified security policies—most will either completely allow or completely deny a particular service.

Download article Developing Secure Web Applications