Google Research

Please Permit Me: Stateless Delegated Authorization in Mashups

  • Ragib Hasan
  • Marianne Winslett
  • Richard Conlan
  • Brian Slesinsky
  • Nandakumar Ramani
Proceedings of the Annual Computer Security Applications Conference, IEEE Press, Anaheim, CA (2008), pp. 173-182


Mashups have emerged as a Web 2.0 phenomenon, connecting disjoint applications together to provide unified services. However, scalable access control for mashups is difficult. To enable a mashup to gather data from legacy applications and services, users must give the mashup their login names and passwords for those services. This all-or-nothing approach violates the principle of least privilege (not to mention the terms of service) and leaves users vulnerable to misuse of their credentials by malicious mashups.

In this paper, we introduce Permits - a stateless approach to access rights delegation in mashups - and describe our complete implementation of a permit-based authorization delegation service.

Learn more about how we do research

We maintain a portfolio of research projects, providing individuals and teams the freedom to emphasize specific types of work