Security Approaches in Model-Driven Engineering for Web Applications: the State-of-the-art in the Last 10 Years

In the past decade, several approaches have been proposed for integrating security requirements into the model-driven engineering (MDE) of web applications. However, very little has been done to consolidate the knowledge about these approaches and analyze them from the perspective of common security threats, such as those listed in the Top 10 list of OWASP. This systematic literature review provides a state-of-the-art overview of the newly proposed approaches. It consolidates what is currently known about the level of their empirical evaluation and the extent to which each addresses the threats in the Top 10 list of OWASP. We examined 181 publications, of which 11 articles proposed new approaches to integrating security into the MDE of web applications. Our analysis of these 11 approaches reveals that most of them address the threat of Broken Access Control and that no approach exists that addresses all threats in the Top 10 list. Compared to a decade ago, we could see a clear trend towards using aspect-oriented methods to integrate security into MDE for web apps. Finally, we reflect on the implications of our results and the limitations of this work.