Establishing and enforcing security and privacy policies in web-based applications

A system for implementing security and privacy policy in a web application, the system comprising:

• a web server configured for connection to a user computer via a network, the web application running on the web server and having an execution environment in which a representation of each object handled by the execution environment accommodates data and an associated tag;
• a configuration module for storing at least one inbound tagging rule for tagging inbound objects according to a respective source of each of the inbound objects, and storing at least one security/privacy rule for performing security/privacy actions on outbound objects according to a respective tag of each of the outbound objects;
• a first security module running on the web server and being functionally positioned between the user computer and a front end of the web application, the first security module being configured to assign a tag to an object being operated on by the execution environment based on the at least one inbound tagging rule;
• and
• a second security module running on the web server and being functionally positioned between a middle end of the web application and at least one back-end application, the second security module being configured to perform a security/privacy action on the object being operated on by the execution environment based on the at least one security/privacy rule.

A computer program product, comprising computer code in a computer-usable medium, for implementing security and privacy policy in a web application having an execution environment in which a representation of each object handled by the execution environment accommodates data and an associated tag, the computer code comprising:

• code for establishing at least one inbound tagging rule for tagging inbound objects according to a respective source of each of the inbound objects;
• code for assigning a tag to an object being operated on by the execution environment based on the at least one inbound tagging rule;
• code for establishing at least one security/privacy rule for performing security/privacy actions on outbound objects according to a respective tag of each of the outbound objects;
• and
• code for performing a security/privacy action on the object being operated on by the execution environment based on the at least one security/privacy rule.