CoChat
Sign Up
Cited by 14Web Application Security VulnerabilitiesMobile and Web ApplicationsSecurity and Verification in Computing

The DOI matches its Crossref record; 1 of the 1 references it cites were found in a registry or an index.

An Empirical Study of the Use of Integrity Verification Mechanisms for Web Subresources

Open access
Chapuis, Bertil, Omolola, Olamide, Cherubini, Mauro, Humbert, Mathias, Huguenin, Kévin·2020·Proceedings of The Web Conference 2020
DOI 10.1145/3366423.3380092
Open this paper in CoChat — free account

Abstract

Web developers can (and do) include subresources such as scripts, stylesheets and images in their webpages. Such subresources might be stored on content delivery networks (CDNs). This practice creates security and privacy risks, should a subresource be corrupted. The subresource integrity (SRI) recommendation, released in mid-2016 by the W3C, enables developers to include digests in their webpages in order for web browsers to verify the integrity of subresources before loading them. In this paper, we conduct the first large-scale longitudinal study of the use of SRI on the Web by analyzing massive crawls (≈ 3B URLs) of the Web over the last 3.5 years. Our results show that the adoption of SRI is modest (≈), but grows at an increasing rate and is highly influenced by the practices of popular library developers (e.g., Bootstrap) and CDN operators (e.g., jsDelivr). We complement our analysis about SRI with a survey of web developers (N=): It shows that a substantial proportion of developers know SRI and understand its basic functioning, but most of them ignore important aspects of the recommendation. The results of the survey also show that the integration of SRI by developers is mostly manual – hence not scalable and error prone. This calls for a better integration of SRI in build tools.

Overview

Integrity signals

Registry

Crossref · 10.1145/3366423.3380092

Cites

1 of 1 references verified0 citation errors · 0 not checkable

Statistics

Recomputing p-values needs the paper’s full text.

Verification

Claims the paper makes

We couldn’t retrieve this paper’s full text, so its claims and self-check weren’t run. The registry and citation checks still apply.

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • SRI deployment has been increasing over 3.5 years, but this is mostly related to widely-used libraries such as jQuery having example code with SRI.

    “Chapuis, et al. [3] conducted a longitudinal analysis of SRI deployment in 3.5 years, starting from the first recommendation of its use in 2016. They observed an increasing deployment of SRI, but also that this is mostly related to widely-used libraries such as jQuery having example code with SRI.”

    From HTTP Security Headers Analysis of Several Macedonian Website Categories (2025) · cites this paper as [3]

  • Even if framing controls are well implemented because protection is delegated to web browsers, there are inconsistencies in the security guarantees offered to users of different browsers.

    “One research [2] showed that even if these framing controls are well implemented because protection is delegated to web browsers, there are some inconsistencies in the security guarantees offered to users of different browsers.”

    From HTTP Security Headers Analysis of Several Macedonian Website Categories (2025) · cites this paper as [2]

Citations

Cites

Flagged first, then by citations

Research works printed but not linked: 35

  1. 10.1109/SP.2016.25 · DOI
  2. Devdatta Akhawe and Adrienne Porter Felt . 2013 . Alice in Warningland: A Large-Scale Field Study of Browser Security Warning Effectiveness .. In Proc. of the USENIX Security Symp. (USENIX Security). USENIX, Washington D.C., USA, 257–272 . Devdatta Akhawe and Adrienne Porter Felt. 2013. Alice in Warningland: A Large-Scale Field Study of Browser Security Warning Effectiveness.. In Proc. of the USENIX Security Symp. (USENIX Security). USENIX, Washington D.C., USA, 257–272.
  3. A. Anis M. Zulkernine S. Iqbal C. Liem and C. Chambers. 2018. Securing Web Applications with Secure Coding Practices and Integrity Verification. In Proc. of the IEEE Int'l Conf. on Dependable Autonomic and Secure Computing Int'l Conf on Pervasive Intelligence and Computing 4th Int'l Conf on Big Data Intelligence and Computing and Cyber Science and Technology Congress(DASC/PiCom/DataCom/CyberSciTech). IEEE Athens Greece 618-625. https://doi.org/10.1109/DASC/PiCom/DataCom/CyberSciTec.2018.00112 10.1109/DASC · DOI
  4. A. Anis M. Zulkernine S. Iqbal C. Liem and C. Chambers. 2018. Securing Web Applications with Secure Coding Practices and Integrity Verification. In Proc. of the IEEE Int'l Conf. on Dependable Autonomic and Secure Computing Int'l Conf on Pervasive Intelligence and Computing 4th Int'l Conf on Big Data Intelligence and Computing and Cyber Science and Technology Congress(DASC/PiCom/DataCom/CyberSciTech). IEEE Athens Greece 618-625. https://doi.org/10.1109/DASC/PiCom/DataCom/CyberSciTec.2018.00112 · DOI
  5. Sajjad Arshad , Amin Kharraz , and William Robertson . 2016 . Include Me Out: In-Browser Detection of Malicious Third-Party Content Inclusions . In Proc. of the Int’l Conf. on Financial Cryptography and Data Security (FC), Jens Grossklags and Bart Preneel (Eds.). Springer, Christ Church, Barbados, 441–459 . https://doi.org/10.1007/978-3-662-54970-4_26 10.1007/978-3-662-54970-4_26 Sajjad Arshad, Amin Kharraz, and William Robertson. 2016. Include Me Out: In-Browser Detection of Malicious Third-Party Content Inclusions. In Proc. of the Int’l Conf. on Financial Cryptography and Data Security (FC), Jens Grossklags and Bart Preneel (Eds.). Springer, Christ Church, Barbados, 441–459. https://doi.org/10.1007/978-3-662-54970-4_26 · DOI
  6. 10.1145/3178876.3186090 · DOI
  7. 10.14722/usec.2014.23006 · DOI
  8. 10.1016/j.jlap.2013.05.001 · DOI
  9. Clemens H. Cap and Benjamin Leiding . 2018 . Ensuring Resource Trust and Integrity in Web Browsers Using Blockchain Technology. In Advanced Information Systems Engineering Workshops(Lecture Notes in Business Information Processing), Raimundas Matulevičius and Remco Dijkman (Eds.). Springer , 115–125. Clemens H. Cap and Benjamin Leiding. 2018. Ensuring Resource Trust and Integrity in Web Browsers Using Blockchain Technology. In Advanced Information Systems Engineering Workshops(Lecture Notes in Business Information Processing), Raimundas Matulevičius and Remco Dijkman (Eds.). Springer, 115–125.
  10. 10.1145/3243734.3243746 · DOI
  11. 10.1145/1357054.1357219 · DOI
  12. 10.1007/978-3-642-39884-1_5 · DOI
  13. 10.1145/2702123.2702442 · DOI
  14. Adrienne Porter Felt , Richard Barnes , April King , Chris Palmer , Chris Bentzel , and Parisa Tabriz . 2017 . Measuring HTTPS Adoption on the Web . In Proc. of the USENIX Security Symp. (USENIX Security). USENIX , Vancouver, BC, Canada, 16. Adrienne Porter Felt, Richard Barnes, April King, Chris Palmer, Chris Bentzel, and Parisa Tabriz. 2017. Measuring HTTPS Adoption on the Web. In Proc. of the USENIX Security Symp. (USENIX Security). USENIX, Vancouver, BC, Canada, 16.
  15. 10.1287/isre.2016.0644 · DOI
  16. 10.1109/SecDev.2016.033 · DOI
  17. 10.1109/SP.2019.00060 · DOI
  18. 10.1145/3038912.3052686 · DOI
  19. 10.14722/ndss.2017.23414 · DOI
  20. 10.23919/CYCON.2018.8405025 · DOI · Paper page
  21. Michael Mikowski and Josh Powell . 2013. Single Page Web Applications: JavaScript End-to-End ( 1 st ed.). Manning Publications Co. , Greenwich, CT, USA . Michael Mikowski and Josh Powell. 2013. Single Page Web Applications: JavaScript End-to-End (1st ed.). Manning Publications Co., Greenwich, CT, USA.
  22. 10.1016/j.chb.2014.09.014 · DOI
  23. 10.1145/3321705.3329841 · DOI
  24. 10.1145/2382196.2382274 · DOI
  25. 10.1145/3173574.3174086 · DOI
  26. Franziska Roesner , Tadayoshi Kohno , and David Wetherall . 2012 . Detecting and Defending Against Third-Party Tracking on the Web . In Proc. of the Symp. on Networked Systems Design and Implementation (NSDI). USENIX , San Jose, CA, USA, 14. Franziska Roesner, Tadayoshi Kohno, and David Wetherall. 2012. Detecting and Defending Against Third-Party Tracking on the Web. In Proc. of the Symp. on Networked Systems Design and Implementation (NSDI). USENIX, San Jose, CA, USA, 14.
  27. Johnny Saldaña . 2015. The Coding Manual for Qualitative Researchers . Sage, Arizona State University, USA. Johnny Saldaña. 2015. The Coding Manual for Qualitative Researchers. Sage, Arizona State University, USA.
  28. 10.1007/978-3-030-05918-7_21 · DOI
  29. 10.1504/IJSN.2018.092474 · DOI
  30. Ronak N Shah and Kailas R Patil . 2017 . Securing Third-Party Web Resources Using Subresource Integrity Automation . International Journal on Emerging Trends in Technology 4 , 2 (2017), 5 . Ronak N Shah and Kailas R Patil. 2017. Securing Third-Party Web Resources Using Subresource Integrity Automation. International Journal on Emerging Trends in Technology 4, 2 (2017), 5.
  31. 10.1007/978-3-319-62105-0_8 · DOI
  32. 10.1145/2810103.2813710 · DOI
  33. E. Stark , R. Sleevi , R. Muminovic , D. O’Brien , E. Messeri , A. Felt , B. McMillion , and P. Tabriz . 2019. Does Certificate Transparency Break the Web? Measuring Adoption and Error Rate . In Proc. of the IEEE Symp. on Security and Privacy (S&P). IEEE , Los Alamitos, CA, USA, 463–478. https://doi.org/10.1109/SP. 2019 .00027 10.1109/SP.2019.00027 E. Stark, R. Sleevi, R. Muminovic, D. O’Brien, E. Messeri, A. Felt, B. McMillion, and P. Tabriz. 2019. Does Certificate Transparency Break the Web? Measuring Adoption and Error Rate. In Proc. of the IEEE Symp. on Security and Privacy (S&P). IEEE, Los Alamitos, CA, USA, 463–478. https://doi.org/10.1109/SP.2019.00027 · DOI
  34. 10.1109/EuroSPW.2019.00021 · DOI
  35. 10.1145/3019612.3019798 · DOI

Cited by

Sorted by citations

Metadata

Authors
Chapuis, B., Omolola, O., Cherubini, M., Humbert, M., & Huguenin, K.
Affiliations
  • University of Lausanne (CH)
  • Graz University of Technology (AT)
  • Bundesamt für Rüstung armasuisse (CH)
ORCID
Venue
Proceedings of The Web Conference 2020
Publisher
ACM
Published
2020-04-20
Pages
34-45
DOI
10.1145/3366423.3380092
OpenAlex
W3002929229
Cited by
14
References
1
Citations by year
2025: 2 · 2024: 2 · 2023: 3 · 2022: 4 · 2021: 1 · 2020: 2
FWCI
1.90
Type
conference paper
Language
en
Open access
Licence
Locations
  • International World Wide Web Conference (WWW) (publishedVersion, cc-by)
  • SERVAL (Université de Lausanne) (publishedVersion, cc-by)
  • IRIS (submittedVersion, cc-by)
  • HAL (submittedVersion, other-oa)
  • ArODES (HES-SO (https://www.hes-so.ch/)) (submittedVersion)
  • SERVAL (Université de Lausanne) (submittedVersion, cc-by)
Funders
Hasler Stiftung (19024)
Topics
  • Physical Sciences › Computer Science › Information Systems › Web Application Security Vulnerabilities
  • Physical Sciences › Computer Science › Information Systems › Mobile and Web Applications
  • Physical Sciences › Computer Science › Hardware and Architecture › Security and Verification in Computing
Keywords
content delivery networks, web security, online privacy, web crawls, build tools

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review