Confused Deputy Problem

Here is a dense description of the Confused Deputy Problem. The Deputy The deputy is a program that is called upon (deputized) by a client to perform some action and at the same time granted by the client temporary authority to take that action. The client provides a name of a resource upon which to take the action. The deputy has additional built-in authority to take other actions that are a necessary part of its job. The Confused Deputy The client names a resource to which it lacks authority. The deputy attempts its normal act on the resource named by its client. The deputy's act is permitted by security mechanisms because the deputy's built-in authority is sufficient for this act. The deputy has unwittingly abetted an indirect action by its client that the security rules were designed to prevent. The deputy has unwittingly abused its own built-in authority. The deputy is blameless if the semantics of the system did not allow it to say that the act was to be subject to its client's authority. Capability Style Solution Capabilities solve this implicitly in that the name supplied by the client to the deputy is a capability which naturally includes the necessary authority. The deputy's action is via that capability. The client is unable to provide a capability that by hypothesis it lacks.