Skip to Main content Skip to Navigation
New interface
Conference papers

Securing Web Applications with Predicate Access Control

Abstract : Web application security is an increasingly important concern as we entrust these applications to handle sensitive user data. Security vulnerabilities in these applications are quite common, however, allowing malicious users to steal other application users’ data. A more reliable mechanism for enforcing application security policies is needed. Most applications rely on a database to store user data, making it a natural point to introduce additional access controls. Unfortunately, existing database access control mechanisms are too coarse-grained to express an application security policy. In this paper we propose and implement a fine-grained access control mechanism for controlling access to user data. Application access control policy is expressed using row-level access predicates, which allow an application’s access control policy to be extended to the database. These predicates are expressed using the SQL syntax familiar to developers, minimizing the developer effort necessary to take advantage of this mechanism. We implement our predicate access control system in the PostgreSQL 9.2 DBMS and evaluate our system by developing an access control policy for the Drupal 7 and Spree Commerce. Our mechanism protected Drupal and Spree against five known security vulnerabilities.
Document type :
Conference papers
Complete list of metadata

Cited literature [10 references]  Display  Hide  Download
Contributor : Hal Ifip Connect in order to contact the contributor
Submitted on : Monday, January 15, 2018 - 2:07:31 PM
Last modification on : Wednesday, August 7, 2019 - 12:14:40 PM
Long-term archiving on: : Sunday, May 6, 2018 - 7:53:38 PM


Files produced by the author(s)


Distributed under a Creative Commons Attribution 4.0 International License



Zhaomo Yang, Kirill Levchenko. Securing Web Applications with Predicate Access Control. 31th IFIP Annual Conference on Data and Applications Security and Privacy (DBSEC), Jul 2017, Philadelphia, PA, United States. pp.541-554, ⟨10.1007/978-3-319-61176-1_30⟩. ⟨hal-01684360⟩



Record views


Files downloads