Establishing and enforcing security and privacy policies in web-based applications

A method, executing on hardware, for implementing privacy protection in a web application, wherein the web application is executed in a web application language execution environment within a web server, the method comprising:

• establishing at least one inbound tagging rule for tagging objects entering the web application language execution environment, referred to as inbound objects, according to a respective source of each of the inbound objects;
• assigning a tag to at least one of the inbound objects being operated on by the web application language execution environment based on the at least one inbound tagging rule;
• establishing at least one privacy rule for performing privacy actions on at least one object that is outbound from the web application language execution environment, referred to as outbound objects, according to a respective tag of each of the outbound objects;
• and
• performing a privacy action on the at least one outbound object being operated on by the web application language execution environment based on the at least one privacy rule;
• detecting at least one attack which violates the at least one privacy rule, wherein the detection of the attack comprises a lexical analysis of the data of the object being operated on by the web application language execution environment checking the tags assigned to the outbound object.