A web-based application is a dynamic application that is accessed via the worldwide web. For example, these web-based applications may provide diverse services such as web mail, blogs, search engines, and discussion boards, etc. As users become more knowledgeable of web-based applications and the functionality of web-based applications, the vulnerabilities of these web-based applications are also known. With these vulnerabilities, the risk of users' sensitive information, users' computer systems, users' computer networks, and/or the worldwide web, etc., being infiltrated or compromised by malicious data, also increases. By way of example, malicious data infiltrating a web-based application may cause a significant amount of damage to other users of the web-based application and/or the web-based application itself. Therefore, detecting and/or blocking the malicious data more efficiently and efficiently is a critical task for individuals and organizations alike.
One technique to detecting malicious data involves the utilization of an input filtering mechanism. An input filtering mechanism may function as a filtering layer between one or more users and the web-based application in order to help inhibit malicious data. Another technique for detecting malicious data requires the user to download a filtering program so that the data can be filtered before it is submitted.
Consider the situation wherein, for example, a user wants to access a web-based blogging application, for example, www.blogwidget.com, in order to input their daily journal entries. The user first enters the URL (“www.blogwidget.com”) into the browser's address bar. In order to access the web-based application, the web-based application provider may prompt the user to login by providing a HTML input form, for example, www.blogwidget/login.html, to the user's browser. This HTML input form requires the user to input, for example, their username and password before access is granted to the web-based blogging application.
After the user inputs the required login information into the provided HTML input form and hits “submit”, the login data, or the HTML input form data, is then transmitted to a target URL of a receiving module of the web-based application (for example, www.blogwidget/target.cgi) that is specified in the HTML input form. The receiving module of the web-based application would then forward the HTML input form data to the web-based application. It is then up to the web-based application provider to do his own access control, using the login data, to decide whether to grant or deny access by the user to www.blogwidget.com.
If the web-based application provider decides to grant the user access to the web-based application (www.blogwidget.com), the web-based application provider in this example may provide the user with an additional HTML input form, for example, www.blogwidget/journal.html, so that the user can then enter his or her daily journal entry.
Similar to the login HTML input form, once the user inputs his or her daily journal entry into the data fields provided and hits “submit”, before the daily journal entry is posted to the blog site, the HTML input form data is first transmitted to a target URL of the receiving module of the web-based application (for example, www.blogwidget/target cgi), that is specified in the journal HTML input form.
The receiving module of the web-based application would then forward the HTML input form data to the web-based application. It is then up to the web-based application provider to do his or her own content filtering or malicious data detection on the entered form data in order to allow or disallow the daily journal entry to be posted on www.blogwidget.com.
Traditionally, for the web-based application provider to perform data filtering of the inputted information by the user, the web-based application provider has to provision (i.e., install and/or maintain and/or update) the data filtering mechanism. Typically, the installation and maintenance of the data filtering mechanism requires specialized programmers to be hired, which can be expensive and time consuming for a typical business.
As the worldwide web continues to evolve, so do the types of malicious threats. Therefore, not only does the web-based application provider initially have to install an input filtering mechanism, but also has to continuously update and maintain the filtering mechanism. The amount of resources required to properly install and maintain such a filtering mechanism may be out of reach for some entities. Similar considerations exist with respect to installing and maintaining the access control mechanism.
As mentioned, an alternative approach requires the user to install and maintain client-based data filtering mechanism and/or access control mechanism to perform data filtering and/or access control at the client browser. However, this approach is not wholly satisfactory since some users may not have the expertise or be diligent in installing and/or maintaining such data filtering mechanism and/or access control mechanism.