New Frontiers in HTML5

The discussion around the usual suspects of web application security (XSS, CSRF, injections, etc) hasn’t changed much in the last decade. Even high-profile website security incidents that get media attention often boil down to a clever application of one or more of these “basic” vulnerabilities. Part of the reason these techniques don’t seem to go out of style is a result of the speed at which the underlying technologies emerge.

In other words, as technology changes, the vulnerabilities enabled by that technology also change. With the quick rise (and rapid acceptance) of HTML5 as the next generation markup language, we are sure to see some interesting new ways that web apps can be bent and broken or otherwise convinced to do things they were not originally designed or developed to do. Indeed, HTML5 seems to be somewhat of a new frontier when it comes to web security. Like its predecessor, each browser rendering engine has its own way of interpreting and displaying HTML5 data. Developers seeking to fully secure their applications would need to account for users that may have HTML5-enabled browsers. Lack of familiarity on the developer’s part can result in unexpected vulnerabilities that are easily overlooked or difficult to detect.

The HTML5 Security Cheatsheet is a resource that shows some things to watch out for when you’re working with HTML5, and should be useful to both developers and regular users.

Also, it’s important to point out that not all unintended uses of a new technology are malicious in nature. Who knows– maybe some HTML5 hack will push future web innovation to new heights. At the very least, it could add some variety to the global discussion on web application security.