Guarda: A web application firewall for WebAuthn transaction authentication
Transaction authentication is an attractive extension to two-factor authentication. It is proposed in the WebAuthn standard by the World-Wide-Web Consortium (W3C) as a mechanism to secure individual “high-risk” operations of a website via a hardware authenticator device. It defends against a stringe...
| Main Author: | |
|---|---|
| Other Authors: | |
| Format: | Thesis |
| Published: |
Massachusetts Institute of Technology
2022
|
| Online Access: | https://hdl.handle.net/1721.1/139135 |
| _version_ | 1826213846357901312 |
|---|---|
| author | Barabonkov, Damian |
| author2 | Athalye, Anish |
| author_facet | Athalye, Anish Barabonkov, Damian |
| author_sort | Barabonkov, Damian |
| collection | MIT |
| description | Transaction authentication is an attractive extension to two-factor authentication. It is proposed in the WebAuthn standard by the World-Wide-Web Consortium (W3C) as a mechanism to secure individual “high-risk” operations of a website via a hardware authenticator device. It defends against a stringent threat model where an adversary can modify or create HTTP requests between the user and the web service. Transaction authentication as defined by WebAuthn is not yet adopted in practice, partially because it requires intrusive web application changes.
This thesis presents Guarda, a firewall for integrating transaction authentication into a new or existing web service with relatively few code changes. The firewall intercepts all HTTP traffic sent to the web service, and based on the configuration, any requests deemed safe are proxied directly to the web service. All other requests are considered high-risk and are held back and validated using transaction authentication. Only if the validation passes are they also permitted to pass through to the web service.
This thesis uses the firewall approach to integrate transaction authentication into three web applications: a blogging site named Conduit, a WordPress admin panel named Calypso and a self-hosted Git service named Gogs. Compared to directly modifying them to support transaction authentication, the firewall approach is close to 8 times more concise. Under heavy load, there is an associated latency of at worst 1.5x slower when using Guarda to secure Gogs versus accessing the web service directly without WebAuthn. |
| first_indexed | 2024-09-23T15:55:46Z |
| format | Thesis |
| id | mit-1721.1/139135 |
| institution | Massachusetts Institute of Technology |
| last_indexed | 2024-09-23T15:55:46Z |
| publishDate | 2022 |
| publisher | Massachusetts Institute of Technology |
| record_format | dspace |
| spelling | mit-1721.1/1391352022-01-15T03:06:38Z Guarda: A web application firewall for WebAuthn transaction authentication Barabonkov, Damian Athalye, Anish Kaashoek, M. Frans Massachusetts Institute of Technology. Department of Electrical Engineering and Computer Science Transaction authentication is an attractive extension to two-factor authentication. It is proposed in the WebAuthn standard by the World-Wide-Web Consortium (W3C) as a mechanism to secure individual “high-risk” operations of a website via a hardware authenticator device. It defends against a stringent threat model where an adversary can modify or create HTTP requests between the user and the web service. Transaction authentication as defined by WebAuthn is not yet adopted in practice, partially because it requires intrusive web application changes. This thesis presents Guarda, a firewall for integrating transaction authentication into a new or existing web service with relatively few code changes. The firewall intercepts all HTTP traffic sent to the web service, and based on the configuration, any requests deemed safe are proxied directly to the web service. All other requests are considered high-risk and are held back and validated using transaction authentication. Only if the validation passes are they also permitted to pass through to the web service. This thesis uses the firewall approach to integrate transaction authentication into three web applications: a blogging site named Conduit, a WordPress admin panel named Calypso and a self-hosted Git service named Gogs. Compared to directly modifying them to support transaction authentication, the firewall approach is close to 8 times more concise. Under heavy load, there is an associated latency of at worst 1.5x slower when using Guarda to secure Gogs versus accessing the web service directly without WebAuthn. M.Eng. 2022-01-14T14:52:00Z 2022-01-14T14:52:00Z 2021-06 2021-06-17T20:12:50.443Z Thesis https://hdl.handle.net/1721.1/139135 In Copyright - Educational Use Permitted Copyright MIT http://rightsstatements.org/page/InC-EDU/1.0/ application/pdf Massachusetts Institute of Technology |
| spellingShingle | Barabonkov, Damian Guarda: A web application firewall for WebAuthn transaction authentication |
| title | Guarda: A web application firewall for WebAuthn transaction authentication |
| title_full | Guarda: A web application firewall for WebAuthn transaction authentication |
| title_fullStr | Guarda: A web application firewall for WebAuthn transaction authentication |
| title_full_unstemmed | Guarda: A web application firewall for WebAuthn transaction authentication |
| title_short | Guarda: A web application firewall for WebAuthn transaction authentication |
| title_sort | guarda a web application firewall for webauthn transaction authentication |
| url | https://hdl.handle.net/1721.1/139135 |
| work_keys_str_mv | AT barabonkovdamian guardaawebapplicationfirewallforwebauthntransactionauthentication |