This threat model considers the core LWS architecture:
+ three external entities (User, Application Admin, and
+ Storage Controller), four containers (the CID Provider,
+ the User Authorization Server, the Application
+ Provider, and the LWS Storage), and the data flows
+ connecting them.
+
+
+
+ Data Flow Diagram for LWS Threat Model
+
+
+
+ Data Flow Diagram for LWS Threat Model
+ (source: lws.c4)
+
+
+
+
Data Flow Description
+
This diagram models the core interactions in an LWS system where
+ authentication uses CID Documents.
note:We
+ did not yet model potential attackers apart from the actors already existed,
+ as over-characterizing attackers can lead to over complication or analysis bias.
+
The CID Provider (C1) and User Authorization Server
+ (C2) are modeled separately, though in practice they may be
+ provided by the same service. The Application Provider
+ (C3) may deliver the LWS Client as a web
+ application, a native app, or a server-side process. The
+ LWS Storage (C4) encompasses both the
+ LWS Server hosting LWS resources and its
+ Resource Authorization Server — these are modeled as
+ separate components because they may be operated independently.
+
This threat model focuses on the LWS protocol layer. Threats
+ to underlying transport security (TLS), DNS, and the physical
+ or operating-system layers are out of scope except where they
+ directly enable attacks on LWS-specific flows.
An agent responsible for developing, deploying or configuring an
+ LWS Client that accesses resources on behalf of Users.
+
+
+
E3
+ Resource Owner
+
An agent that controls all resources in an LWS Storage. The Storage Controller specifies the Resource Authorization Server, and may determine the Access Control policies for Resources in the LWS Storage.
The agent who the LWS Client represents. The User is
+ identified by their CID Document, which specifies basic User
+ information and the User Authorization Server(s) that prove
+ the User’s identity. LWS separates identity, authentication, and
+ storage, so the User independently chooses their CID Provider,
+ User Authorization Server, and LWS Storage
+ provider(s).
+
The User’s security interest is ensuring that their identity is only
+ operationalized by the LWS Clients they authorize, for the
+ period and purpose of their own interests. They may access their own
+ LWS Storage, or other Users’ LWS Storages, meaning the
+ Storage Controller can be the same as or different from the
+ User, leading to different security interests between them. Users may
+ also have widely varying levels of technical expertise.
+
+
E2 Application Admin
+
The agent responsible for developing, deploying, or
+ configuring an LWS Client that accesses
+ LWS resources on behalf of Users. The LWS Client
+ relies on LWS resources in LWS Storages, while it may
+ perform additional actions on them, such as caching or further
+ processing.
+
Ideally, the Application Admin would ensure the LWS Client
+ complies with all LWS protocol specifications and does not perform
+ malicious or stealthy actions on the retrieved data. In practice,
+ the Application Admin does not inherently have a positive security
+ interest — their trustworthiness depends on whether Users trust and
+ utilize the LWS Client they manage. From a threat modeling
+ perspective, the LWS Client must be treated as potentially
+ untrusted, even when acting on behalf of the User.
The Storage Controller’s security interest is in ensuring the
+ security of the LWS resources — that only trusted or
+ authorized Users and LWS Clients can access them. That is
+ typically accomplished by the Resource Authorization Server
+ correctly validating authentication credentials and issuing
+ access tokens only for authorized access, access control policies
+ being correctly enforced, and the LWS resources under their
+ control being protected from unauthorized access or modification.
+
+
+
Threats
+
+
+
+
+
+
+
+
+
\ No newline at end of file
diff --git a/threat-model/lws.png b/threat-model/lws.png
new file mode 100644
index 0000000..7d85b4c
Binary files /dev/null and b/threat-model/lws.png differ
diff --git a/threat-model/threats/outline.js b/threat-model/threats/outline.js
new file mode 100644
index 0000000..9ddc17f
--- /dev/null
+++ b/threat-model/threats/outline.js
@@ -0,0 +1,11 @@
+(function () {
+ var threatCategories = [
+ {
+ name: "Client Threats",
+ id: "threat-model-client-threats",
+ threats: ["T1", "T2", "T3", "T4"],
+ },
+ ];
+
+ window.ThreatModel.registerCategories(threatCategories);
+})();
diff --git a/threat-model/threats/t1-injected-identity-providers.js b/threat-model/threats/t1-injected-identity-providers.js
new file mode 100644
index 0000000..44b339f
--- /dev/null
+++ b/threat-model/threats/t1-injected-identity-providers.js
@@ -0,0 +1,26 @@
+(function () {
+ var threat = {
+ id: "T1",
+ name: "Injected Identity Providers",
+ desc: "The Client may tamper the User's Web-CID Document, given it has right permissions. It may inject a malicious *issuer* itself controls, directly leading to user impersonation.",
+ response: [
+ {
+ id: "R1",
+ name: "Access Control Protection",
+ type: "Reduce",
+ desc: 'The User or Agent sets appropriate Access Control rules, permitting only trustworthy Clients in modifying the content of the Web-CID Document. Care should be taken not to disallow *any* modifications from any Client. The power of this response depends on the Access Control model the Authorization Server supports.',
+ },
+ {
+ id: "R2",
+ name: "External Web-CID Document",
+ type: "Reduce",
+ desc: "Instead of having the Web-CID Document as an LWS Resource, serve it as an external resource. This prevents the LWS Client from modifying Web-CID Document through LWS protocol; the external service can use custom mechanisms to protect the Web-CID Document. But this does not prevent the same LWS Client supporting other protocols to modify the Web-CID Document.",
+ },
+ ],
+ elements: ["P1", "C2", "C3", "C4"],
+ taxonomyName: "STRIDE",
+ taxonomyClass: "Spoofing",
+ };
+
+ window.ThreatModel.register(threat);
+})();
diff --git a/threat-model/threats/t2-impersonation-through-credentials.js b/threat-model/threats/t2-impersonation-through-credentials.js
new file mode 100644
index 0000000..973e065
--- /dev/null
+++ b/threat-model/threats/t2-impersonation-through-credentials.js
@@ -0,0 +1,26 @@
+(function () {
+ var threat = {
+ id: "T2",
+ name: "Impersonation through Credentials",
+ desc: "The LWS Client may impersonate the User by using the user' access Credentials to access LWS Resources without the user's knowledge.",
+ response: [
+ {
+ id: "R2",
+ name: "Frontend-only Ephemeral Apps",
+ type: "Reduce",
+ desc: "Requiring the Client to be an ephemeral app, whose whole lifecycle is in the browser, and does not store anything externally (apart from the LWS Resources). This circumvents the impersonation from the current Client.",
+ },
+ {
+ id: "R3",
+ name: "Securely Manages Access Credentials",
+ type: "Transfer",
+ desc: "The User's access Credentials are securely stored and managed in a location where only the corresponding Client can use (e.g. browser's Cookie with `HttpOnly` and `Strict`). This prohibits Client B from using the Credentials issues to Client A. This transfers the threat from the Client or Client Admin to the underlying technology (e.g. browser).",
+ },
+ ],
+ elements: ["P3", "P4", "P5"],
+ taxonomyName: "STRIDE",
+ taxonomyClass: "Spoofing",
+ };
+
+ window.ThreatModel.register(threat);
+})();
diff --git a/threat-model/threats/t3-client-id-impersonation.js b/threat-model/threats/t3-client-id-impersonation.js
new file mode 100644
index 0000000..08cafb8
--- /dev/null
+++ b/threat-model/threats/t3-client-id-impersonation.js
@@ -0,0 +1,20 @@
+(function () {
+ var threat = {
+ id: "T3",
+ name: "Client ID Impersonation (to User Authorization Server)",
+ desc: "The Client (Client A) may pretend to be another Client (Client B), to gain authorization it should not have.",
+ response: [
+ {
+ id: "R4",
+ name: "CID and Environment Verification (from User Authorization Server)",
+ type: "Reduce",
+ desc: "The User Authorization Server verifies the identity of the Client, by checking the environmental information (e.g., redirect URL) of the Client matches those specified in the Client CID Document. This ensures that the response sent by the User Authorization Server is to a location trusted by the claimed Client CID Document. As long as those specified locations are not compromised, there will be no impersonations.",
+ },
+ ],
+ elements: ["P3", "P2"],
+ taxonomyName: "STRIDE",
+ taxonomyClass: "Spoofing",
+ };
+
+ window.ThreatModel.register(threat);
+})();
diff --git a/threat-model/threats/t4-client-id-impersonation-resource-server.js b/threat-model/threats/t4-client-id-impersonation-resource-server.js
new file mode 100644
index 0000000..172e616
--- /dev/null
+++ b/threat-model/threats/t4-client-id-impersonation-resource-server.js
@@ -0,0 +1,26 @@
+(function () {
+ var threat = {
+ id: "T4",
+ name: "Client ID Impersonation (to Resource Authorization Server)",
+ desc: "The Client (Client A) may pretend to be another Client (Client B), to gain authorization to Resources it should not have.",
+ response: [
+ {
+ id: "R5",
+ name: "Verification and Proof from User Authorization Server",
+ type: "Transfer",
+ desc: "The User Authorization Server verifies the identity of the Client, issuing a proof accompanying the Client's request to Resource Authorization Server, which in turn verifies that the proof is authentic with the User Authorization Server. This transfers the verification to User Authorization Server, thus requiring trusting User Authorization Server.",
+ },
+ {
+ id: "R6",
+ name: "Verification from Resource Authorization Server",
+ type: "Reduce",
+ desc: "The Resource Authorization Server verifies the identity of the Client. Because there is no OIDC redirect during this interaction, this verification requires a different mechanism from the CID Document verification in R4. An appropriate different mechanism is therefore needed.",
+ },
+ ],
+ elements: ["P2", "P3", "P5"],
+ taxonomyName: "STRIDE",
+ taxonomyClass: "Spoofing",
+ };
+
+ window.ThreatModel.register(threat);
+})();
diff --git a/threat-model/threats/threat-model.css b/threat-model/threats/threat-model.css
new file mode 100644
index 0000000..d242ccc
--- /dev/null
+++ b/threat-model/threats/threat-model.css
@@ -0,0 +1,168 @@
+/*
+ * Copyright 2026 Legendary Requirements
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+table.visual-terminology,
+table.dfd-dictionary {
+ padding: 1em;
+ border: 1px solid black;
+}
+
+table.visual-terminology th,
+table.visual-terminology td,
+table.dfd-dictionary th,
+table.dfd-dictionary td {
+ border-bottom: 1px solid black;
+ border-collapse: collapse;
+ padding: 0.5em;
+}
+
+table.visual-terminology tr {
+ border-collapse: collapse;
+}
+
+table.visual-terminology th {
+ width: 11em;
+ font-weight: bold;
+}
+
+table.visual-terminology td.term-def {
+}
+
+table.visual-terminology td.term-img {
+ width: 11em;
+}
+
+table.dfd-dictionary {
+}
+
+table.dfd-dictionary td.dfd-id {
+ width: 3em;
+ font-weight: bold;
+}
+table.dfd-dictionary td.dfd-name {
+ width: 10em;
+}
+table.dfd-dictionary td.dfd-type {
+ width: 6em;
+}
+
+#threat-toc {
+ counter-reset: threat;
+}
+
+ol.threat-toc {
+ list-style: none;
+}
+
+ol.threat-toc li::before {
+ content: "T" attr(value) ". ";
+ font-weight: bold;
+}
+
+ol.threat-toc li.section-title::before {
+ font-weight: bold;
+ counter-increment: none;
+ content: "";
+}
+
+ol.threat-toc li.section-title {
+ font-weight: bold;
+ font-style: italic;
+}
+
+table.threat td.threat-name span.index-link {
+ position: absolute;
+ right: 10px;
+ height: 1em;
+ font-size: small;
+ margin-top: -0.7em;
+ top: 50%;
+}
+ol.threat-toc h5 {
+ margin: 0;
+}
+
+table.threat {
+ border: thin solid black;
+ border-collapse: collapse;
+ margin: 1em 0 1em 0;
+ width: 100%;
+ padding-left: 30px;
+}
+table.threat a.self-link {
+ left: -35px !important;
+}
+table.threat h3,
+table.threat h4,
+table.threat h5 {
+ color: black;
+ margin: 0 0 0 -5px;
+ font-weight: bold;
+ font-style: normal;
+}
+table.threat td {
+ padding: 1em;
+ position: relative;
+ border-bottom: thin solid black;
+}
+
+table.threat td.threat-name {
+ font-weight: bold;
+ background-color: #c9daf7;
+}
+
+table.threat td.response-name {
+ font-weight: bold;
+ background-color: #d9ead4;
+}
+
+table.threat td.affected-component {
+ background-color: #fff2ce;
+}
+table.threat span.component-entry {
+ font-weight: bold;
+}
+table.threat td.analysis-taxonomy {
+ background-color: #fce5ce;
+}
+
+p.threatCategory {
+ font-size: larger;
+ font-weight: bolder;
+ margin: 0;
+}
+
+section.threatDetail {
+ visibility: hidden;
+ height: 1px;
+}
+
+span.threat-tag {
+ border-radius: 4px;
+ padding: 2px 5px;
+ color: white;
+ margin: 0px 2px;
+ font-weight: 100;
+ background-color: black;
+}
+
+span.threat-tag.threat-tag-security {
+ background-color: red;
+}
+
+span.threat-tag.threat-tag-privacy {
+ background-color: blue;
+}
diff --git a/threat-model/threats/threat-model.js b/threat-model/threats/threat-model.js
new file mode 100644
index 0000000..de305a0
--- /dev/null
+++ b/threat-model/threats/threat-model.js
@@ -0,0 +1,366 @@
+/*
+ * Copyright 2026 Legendary Requirements
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+(function () {
+ // set up debugger output
+ // you can toggle different debugging namespaces by adjusting the
+ // value passed via a debug query parameter.
+ // e.g., ?debug=* will turn on all debugging output
+ // while ?debug=render will turn on just the render debugging output
+ // the value is a regex against debugging namespaces
+ ///////////////////////////////////////////////////////////////////////
+ if (typeof debug === "undefined") {
+ var debug = function () {};
+ } else {
+ const params = new URLSearchParams(window.location.search);
+ const debug_param = params.get("debug");
+ if (debug_param) {
+ localStorage.debug = debug_param;
+ console.log(`Debugging ${debug_param} enabled`);
+ }
+ }
+
+ // Set up globals
+ ///////////////////////////////////////////////////////////////////////
+ var threats = []; // Populated by calling RegisterThreats
+ var threatCategories = []; // Populated by calling RegisterCategories
+
+ // render(config, document)
+ // Renders all the threats, creating both a Table of Contents and
+ // Threat Details sections
+ ///////////////////////////////////////////////////////////////////////
+ function render(config, document) {
+ var renderLog = debug("render");
+ console.log("Starting render");
+
+ tocElement = document.querySelector(config.threatModelTocSelector);
+ if (!tocElement) {
+ console.warn("No Threat Toc found. Selector: ${config.threatModelTocSelector}");
+ } else {
+ renderToc(threats, tocElement);
+ }
+
+ detailsElement = document.querySelector(config.threatModelDetailsSelector);
+ if (!detailsElement) {
+ console.warn("No Threat Section found. Selector: ${config.threatModelDetailsSelector}");
+ } else {
+ renderThreats(threats, detailsElement, tocElement);
+ }
+ }
+
+ function areRenderTocInputsGood(threats, tocElement) {
+ console.log("areRenderTocInputsGood", threats, tocElement);
+ if (!threats || !threats.length) {
+ console.warn("No threats to render in renderToc");
+ return false;
+ }
+
+ if (!threatCategories || !threatCategories.length) {
+ console.warn("No threat categories to render in renderToc");
+ return false;
+ }
+
+ if (!tocElement) {
+ console.error(`Target table of contents element must be passed to renderToc, but tocElement is ${tocElement}.`);
+ return false;
+ }
+
+ return true;
+ }
+
+ function renderToc(threats, tocElement) {
+ console.log("renderToc", threats);
+
+ if (!areRenderTocInputsGood(threats, tocElement)) {
+ return;
+ }
+
+ var threatCount = 1;
+ let tocHtml = threatCategories
+ .map((category) => {
+ return `
+
`;
+ }
+
+ return;
+ }
+
+ function getThreat(threatId) {
+ console.log("getThreat", threatId);
+ let threat = threats.find((threat) => threat.id === threatId);
+ return threat;
+ }
+
+ function makeId(threat) {
+ var id = `${threat.id}-${threat.name}`;
+ id = id.toLowerCase();
+ id = id.replace(/ /g, "-");
+ return id;
+ }
+
+ function areRenderThreatInputsGood(threats, detailsElement) {
+ if (!threats || !threats.length) {
+ console.warn("No threats to render in renderThreats");
+ return false;
+ }
+
+ if (!detailsElement) {
+ console.error(`Target Threat Details element must be passed to renderThreats but detailsElement is ${detailsElement}.`);
+ return false;
+ }
+ return true;
+ }
+
+ function renderThreats(threats, detailsElement, tocElement) {
+ console.log("renderThreats", threats);
+
+ // note that tocElement is optional
+ // if not present, the threat will not have a link to the TOC
+ if (!areRenderThreatInputsGood(threats, detailsElement)) {
+ return;
+ }
+
+ let threatsHtml = threatCategories
+ .map((category) => {
+ return `
+
`;
+ }
+
+ function renderTocLink(tocElement) {
+ if (!tocElement) return "";
+
+ var selector = `#${tocElement.id}`; // the toc element MUST have an id
+ return `[Threat List]`;
+ }
+
+ function renderImage(threat) {
+ let image = threat.image;
+
+ console.log("renderImage", threat);
+ if (!threat || !image || !image.src) return "";
+
+ let id = makeId(threat);
+ return `
+
+
+
+
+ ${image.caption}
+
+
+
`;
+ }
+
+ function renderTaxonomy(threat) {
+ let taxonomyName = threat?.taxonomyName;
+ let taxonomyClass = threat?.taxonomyClass;
+
+ console.log("renderTaxonomy", taxonomyName);
+ if (!taxonomyName) return "";
+
+ return `
+
+