Wrappers - a mechanism to support state-based authorization in web applications

Martin S. Olivier, Ehud Gudes

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

1 Scopus citations


The first premise of this paper is that security should ultimately be associated with an application because application semantics have a direct influence on proper protection. The second premise is that applications are generally too complex to be trusted to implement security as specified by the given security policy. These problems are aggravated if the application operates over normal time and space constraints: The best example of such applications is workflow systems where various actors - possibly from multiple organisations - interact on long transactions to complete a given task. The solution presented in this paper is an approach referred to as wrappers: a wrapper is a simple program that has enough knowledge about a specific application's potential states and the actions that are permissible in each state. Using this knowledge, it is able to filter requests that should not reach an application at a given point. It is important to note that wrappers are not intended to subsume the security functionality of an application, but serve as an additional check. The paper presents its concepts in a World-wide Web environment that renders it immediately useful.

Original languageEnglish
Title of host publicationData and Applications Security
Subtitle of host publicationDevelopments and Directions - IFIP TC11 / WG11.3 Fourteenth Annual Working Conference on Database Security
PublisherSpringer New York LLC
Number of pages12
ISBN (Print)0792375149, 9780792375142
StatePublished - 1 Jan 2001
EventIFIP TC11 / WG11.3 14th Annual Working Conference on Database Security - Schoorl, Netherlands
Duration: 21 Aug 200023 Aug 2000

Publication series

NameIFIP Advances in Information and Communication Technology
ISSN (Print)1868-4238


ConferenceIFIP TC11 / WG11.3 14th Annual Working Conference on Database Security

ASJC Scopus subject areas

  • Information Systems
  • Computer Networks and Communications
  • Information Systems and Management


Dive into the research topics of 'Wrappers - a mechanism to support state-based authorization in web applications'. Together they form a unique fingerprint.

Cite this