A4 Article in conference proceedings
A Case-Control Study on the Server-Side Bandages Against XSS

List of Authors: Ruohonen J., Leppänen V.
Publisher: CEUR-WS
Publication year: 2018
Journal: CEUR Workshop Proceedings
Book title *: Proceedings of the Seventh Workshop on Software Quality Analysis, Monitoring, Improvement, and Applications
Journal name in source: CEUR Workshop Proceedings
Volume number: 2217
ISBN: 978-86-7031-473-3


This paper surveys the server-side use of security-related options for protecting websites against cross-site scripting (XSS) attacks. By using data from a bug bounty platform, the use of these header-based options is approached with a case-control study that contrasts popular Internet domains against less popular domains that have explicitly been veried to have been vulnerable to XSS. According to the results based on the analysis of nearly 800 thousand domains, (a) the header-based security options are only infrequently used. However, (b) the domains known to have been vulnerable to XSS have been much less likely to use these options compared to popular domains. Furthermore, (c) the options surveyed tend to statistically form clear latent dimensions, which can be speculated to relate to the eort required to enforce strict security policies for websites.

Downloadable publication

This is an electronic reprint of the original article.
This reprint may differ from the original in pagination and typographic detail. Please cite the original version.

Last updated on 2018-26-10 at 11:37