Exploiting the Structure of Modern Web Applications

Abstract

In this thesis, I show how, in many respects, modern web applications are built with implicit structure, such that several classic problems in computer systems can be tackled in new ways, allowing today’s applications to readily reap security or performance benefits. I apply this to two separate contexts. In the first, I look at the problems of providing some automatic security to web applications by partitioning the server-side code of the application, isolating those partitions, learning access control policies for those partitions, and extending this isolation to front-end code with JavaScript sandboxing. In the second, I look at how modern web applications interact with application caches, and develop a family of cache eviction policies tailored to these needs by focusing on prioritizing individual items to capture how item request frequencies, associated costs, and expiration times affect cache performance.