Home

Swift: making web applications secure by construction

Swift is a language-based approach to building web applications that are secure by construction. Swift applications are written in the Jif language, a Java-based language that incorporates "security-typing" to manage the flow of information within an application. The Swift compiler automatically partitions the application code into a client-side JavaScript application and a server-side Java application, with code placement constrained by declarative information flow policies that strongly enforce the confidentiality and integrity of server-side information.

Swift was recently featured in the "Research Highlights" section of the Communications of the ACM, as a condensed version of an earlier conference paper. The original conference paper is Stephen Chong, Jed Liu, Andrew C. Myers, Xin Qi, K. Vikram, Lantian Zheng, and Xin Zheng, Secure web applications via automatic partitioning, Proceedings of the 21st ACM Symposium on Operating Systems Principles (SOSP'07), pages 31–44, October 2007.

Jif has been mentioned previously on LtU here and here.

By Allan McInnes at 2009-03-22 01:24 | DSL | Software Engineering | other blogs | 8404 reads

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

Excellent move

I think that language enforced input validation in web environment is excellent move. Maybe in 10 years, new web applications will no longer have syntax at all.

However, this move is not new. Perl has had it's -T (Taint) flag for a while now. What it did was it forced You to use regexps on all input before it was considered untainted. A very simple approach. Surprising, that other languages have not picked it up.

By True Konrads at Thu, 2009-04-02 08:52 | login or register to post comments

Taint

There is perhaps some similarity between Jif's information-flow declarations and Perl's Taint mode. But I think that Jif's system allows much more complex security properties than Taint mode. However, Swift goes beyond even that, by allowing developers to write a single application that is then partitioned into client and server pieces in a way that is designed to maintain the specified security properties.

By Allan McInnes at Thu, 2009-04-02 21:53 | login or register to post comments