Collected research

An Expressive Model for the Web Infrastructure: Definition and Application to the BrowserID SSO System

Daniel Fett, Ralf Küsters and Guido Schmitz · ieee-security.org

A Dolev-Yao style formal model of the web infrastructure covering HTTP, DNS, browsers, cookies, web storage and cross-document messaging, precise enough to analyse real applications. Applied to Mozilla's BrowserID single sign-on it exposed critical flaws letting an attacker obtain an identity assertion and log in as a victim; the fixes were adopted by Mozilla.

Record

Researcher

Daniel Fett, Ralf Küsters and Guido Schmitz

Published by

ieee-security.org

Format

Whitepaper

Topic

Identity

In the archive

• Collected in the 2014 research round

Tags

• formal-analysis
• sso
• auth-bypass
• openid
• postmessage
• same-origin-policy
• cookie
• http
• owasp-a01-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of Daniel Fett, Ralf Küsters and Guido Schmitz, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 14 August 2026.