University of Calgary
The rich nature of modern web services and the emerging \"Mash-up\" programming model, make it difficult to predict the potential interactions and usage scenarios that can emerge. Moreover, while the potential security implications for individual client browsers have been widely internalized (e.g., XSS, CSRF, etc.) there is less appreciation of the risks posed in the other direction - of user abuse on web service providers. In particular, the authors argue that web services and pieces of services can be easily combined to create entirely new capabilities that may themselves be at odds with the security policies that providers (or the internet community at large) desire to enforce.