Centralized trust authority for web application components
Techniques to facilitate operation of a centralized trust authority for web application components are disclosed herein. In at least one implementation, a plurality of web resources used to construct web applications is received. Over a secure application programming interface (API), component registration information associated with each of the plurality of web resources is received, provided by producers of the web resources. The plurality of web resources is analyzed to determine unique identities and security attributes for each of the web resources. A plurality of security risk factors is identified for each of the plurality of web resources based on the component registration information and the security attributes determined for each of the web resources. A security profile is generated for each of the plurality of web resources based on the security risk factors identified for each of the web resources.
1. A method of operating a computing system to facilitate operation of a centralized trust authority for web application components, the method comprising:
receiving a plurality of web resources used to construct web applications;
receiving, over a secure application programming interface (API), component registration information associated with each of the plurality of web resources provided by producers of the plurality of web resources;
analyzing the plurality of web resources to determine unique identities and security attributes for each of the plurality of web resources;
identifying a plurality of security risk factors for each of the plurality of web resources based on the component registration information and the security attributes determined for each of the plurality of web resources;
generating a security profile for each of the plurality of web resources based on the plurality of security risk factors identified for each of the plurality of web resources;
receiving an API call that identifies a web object of a web application;
comparing the web object to the unique identities for each of the plurality of web resources to determine one of the plurality of web resources that matches the web object; and
returning the security profile for the one of the plurality of web resources that matches the web object.
2. The method of claim 1 wherein the unique identities for each of the plurality of web resources comprise fingerprints for each of the plurality of web resources, and wherein comparing the web object to the unique identities for each of the plurality of web resources to determine the one of the plurality of web resources that matches the web object comprises comparing a fingerprint of the web object to the fingerprints for each of the plurality of web resources to determine the one of the plurality of web resources that matches the web object.
3. The method of claim 1 wherein analyzing the plurality of web resources to determine the unique identities for each of the plurality of web resources comprises computing hashes of each of the plurality of web resources to determine the unique identities for each of the plurality of web resources.
4. The method of claim 1 further comprising receiving, over the secure API, updated component registration information associated with at least one of the plurality of web resources.
5. The method of claim 1 wherein the component registration information comprises integrity hashes of each of the plurality of web resources provided by the producers of the plurality of web resources.
6. The method of claim 1 wherein the component registration information comprises lists of authorized host domains for each of the plurality of web resources.
7. The method of claim 1 wherein the component registration information comprises version release information for each of the plurality of web resources.
8. One or more computer-readable storage media having program instructions stored thereon to facilitate operation of a centralized trust authority for web application components, wherein the program instructions, when executed by a computing system, direct the computing system to perform operations, the operations comprising:
receiving a plurality of web resources used to construct web applications;
receiving, over a secure application programming interface (API), component registration information associated with each of the plurality of web resources provided by producers of the plurality of web resources;
analyzing the plurality of web resources to determine unique identities and security attributes for each of the plurality of web resources;
identifying a plurality of security risk factors for each of the plurality of web resources based on the component registration information and the security attributes determined for each of the plurality of web resources;
generating a security profile for each of the plurality of web resources based on the plurality of security risk factors identified for each of the plurality of web resources;
receiving an API call that identifies a web object of a web application;
comparing the web object to the unique identities for each of the plurality of web resources to determine one of the plurality of web resources that matches the web object; and
returning the security profile for the one of the plurality of web resources that matches the web object.
9. The one or more computer-readable storage media of claim 8 wherein the unique identities for each of the plurality of web resources comprise fingerprints for each of the plurality of web resources, and wherein comparing the web object to the unique identities for each of the plurality of web resources to determine the one of the plurality of web resources that matches the web object comprises comparing a fingerprint of the web object to the fingerprints for each of the plurality of web resources to determine the one of the plurality of web resources that matches the web object.
10. The one or more computer-readable storage media of claim 8 wherein analyzing the plurality of web resources to determine the unique identities for each of the plurality of web resources comprises computing hashes of each of the plurality of web resources to determine the unique identities for each of the plurality of web resources.
11. The one or more computer-readable storage media of claim 8 wherein the operations further comprise receiving, over the secure API, updated component registration information associated with at least one of the plurality of web resources.
12. The one or more computer-readable storage media of claim 8 wherein the component registration information comprises integrity hashes of each of the plurality of web resources provided by the producers of the plurality of web resources.
13. The one or more computer-readable storage media of claim 8 wherein the component registration information comprises lists of authorized host domains for each of the plurality of web resources.
14. The one or more computer-readable storage media of claim 8 wherein the component registration information comprises version release information for each of the plurality of web resources.
15. An apparatus comprising:
one or more computer-readable storage media;
a processing system operatively coupled with the one or more computer-readable storage media; and
program instructions stored on the one or more computer-readable storage media that, when executed by the processing system, direct the processing system to perform operations, the operations comprising:
receiving a plurality of web resources used to construct web applications;
receiving, over a secure application programming interface (API), component registration information associated with each of the plurality of web resources provided by producers of the plurality of web resources;
analyzing the plurality of web resources to determine unique identities and security attributes for each of the plurality of web resources;
identifying a plurality of security risk factors for each of the plurality of web resources based on the component registration information and the security attributes determined for each of the plurality of web resources;
generating a security profile for each of the plurality of web resources based on the plurality of security risk factors identified for each of the plurality of web resources;
receiving an API call that identifies a web object of a web application;
comparing the web object to the unique identities for each of the plurality of web resources to determine one of the plurality of web resources that matches the web object; and
returning the security profile for the one of the plurality of web resources that matches the web object.
16. The apparatus of claim 15 wherein the unique identities for each of the plurality of web resources comprise fingerprints for each of the plurality of web resources, and wherein comparing the web object to the unique identities for each of the plurality of web resources to determine the one of the plurality of web resources that matches the web object comprises comparing a fingerprint of the web object to the fingerprints for each of the plurality of web resources to determine the one of the plurality of web resources that matches the web object.
17. The apparatus of claim 15 wherein analyzing the plurality of web resources to determine the unique identities for each of the plurality of web resources comprises computing hashes of each of the plurality of web resources to determine the unique identities for each of the plurality of web resources.
18. The apparatus of claim 15 wherein the operations further comprise receiving, over the secure API, updated component registration information associated with at least one of the plurality of web resources.
19. The apparatus of claim 15 wherein the component registration information comprises integrity hashes of each of the plurality of web resources provided by the producers of the plurality of web resources.
20. The apparatus of claim 15 wherein the component registration information comprises lists of authorized host domains for each of the plurality of web resources.