Confirmed users
717
edits
WebAPI/Security/OpenWebApp: Difference between revisions
Jump to navigation
Jump to search
→Trusted (authenticated by publisher)
(Created page with "Name of API: Open Web App API Reference: https://developer.mozilla.org/en/OpenWebApps/The_JavaScript_API Security Discussion: https://groups.google.com/group/mozilla.dev.webapp...") |
|||
| Line 33: | Line 33: | ||
*A "dashboard" can monitor the state of logged in applications | *A "dashboard" can monitor the state of logged in applications | ||
Authorization model: | Authorization model: | ||
*Explicit for Install, Launch and Remove Apps (OS Mediated) | |||
*Implicit for non-state changing operations related to querying about their own state | |||
Potential mitigations: | Potential mitigations: | ||
* uninstall() is a method of the application object itself. Since you can only get apps that you installed from (using getInstalled()) or yourself (using getSelf()) this mitigates the risks. [ | * uninstall() is a method of the application object itself. Since you can only get apps that you installed from (using getInstalled()) or yourself (using getSelf()) this mitigates the risks. [Fabrice] I don't think that a user expects one app to be able to silently uninstall another app just because it initiated the install in the first place.[Lucas] | ||
== Certified (vouched for by trusted 3rd party) == | == Certified (vouched for by trusted 3rd party) == | ||