Handling form security - security

So how do you maintain the form security about posting data to different page problem? For instance you have a member and he/she tries to change the personal settings and you redirected member to
www.domain.com/member/change/member_id
member changed the values and post the data to another page by changing the action with firebug or something else. For instance
www.domain.com/member/change/member_id_2
How do you handle this problem without using sessions?

This problem arises when there are no server side validations!
So, the solution is to have server side validations.

Why not use Session state? It's designed for that.
Alternatively use cookies or URL's with unique session style ID embedded in it, which allows you to tie it back to a specific user.

How do you handle members without session?
Before modifying anything, check if the current user has the right to do so. For example, if you're user #1 and your details are at /members/change/1, you post to the same url, and with firebug you change the form to point to /members/change/2. When processing the form, you have to check if the userid in the form is the current user's id, and if not, display an error.

You could crypt the identity information (member_id) and add it as parameter or url path. When the request is posted to the member_id form, you can verify that the crypted member_id (which is part of the request) matches the member_id.

Related

How can I protect a express route without authentication?

I'm trying to implement a GET method with Express in my nodeJs application.
I'd like to do something like this in order to display user data :
router.get("/user/:idUser", (req, res) => {
The user doesn't need to be authenticated in order to execute this code. However I don't want that anybody can execute this request with a user id of someone else. Because he could see data he's not supposed to see.
How could I proceed ? I thought about using some encryption process to have something like :
/user/PdfgdfJFDGTfrfgdsf
Your question isn't really making sense. You don't want authentication, but you only want a user to be able to view their own data so nobody else can view it.
The ONLY way to solve that is by using some form of authentication. The user has to prove to the server that they are allowed to view that data before the user renders the page for them.
Yes, you could obscure the URL (make it some mostly unguessable string of characters), but it's not clear what problem that is solving. The user themselves won't be able to remember it or type it so it would probably have to be a link in a web page and if it's a link in an unauthenticated web page, then anyone can get to it - thus defeating the purpose.
There are cases where temporary links (often done for privileged downloads) such as what you mention /user/PdfgdfJFDGTfrfgdsf are sent via an authenticated channel (either an authenticated webpage or sent to an email address known to belong to an authenticated user) and these links contain some unique and hard to guess code. The user can then click on that link (in authenticated webpage or in email) and access that resource without further authentication. In that case, the knowledge of the code in the URL is serving as a form of proof of authentication. Because URLs may be logged in service providers or corporate infrastructure and thus not remain entirely private, this technique has its limitations and is typically only used for short term (download this resource in the next 10 minutes) type of uses, not a long term substitute for authentication and not used for things that demand real security. You don't explain enough of your use case to know whether this is practical for your situation or not.
The user doesn't need to be authenticated in order to execute this code. However I don't want that anybody can execute this request with a user id of someone else. Because he could see data he's not supposed to see.
That's an inconsistent statement. You say "user doesn't need to be authenticated in order to execute this code" and then you say "I don't want that anybody can execute this request with a user id of someone else.". You can't have both. The user is either required to prove authorization or they aren't. Pick one. It can't be both.
you can use jwt for this and a auth middleware for this
upon decoding jwt token, you can implement logic to check if the decodedToken.user_id (given that you add user_id when encode token payload) is equal to the :idUser in route (or any kind of logic you want) there.

PUT request without id

I have an API method where the authentication server allows an automatic registration when the user does not exist yet on first login.
The auth server would make a call to:
PUT https://some-api/api/v1/auth/users
The handler of this method will check if the user already exists, and create it when the user does not based on email.
My question is whether there is something inherently wrong with not specifying the id in url upfront. The problem being that in fact, there is no userId yet when the user does not exist.
I know that the usual format would be:
PUT https://some-api/api/v1/auth/users/:userId
Obviously the client can check whether the user exists based on email upfront, create a POST request to create the user, or GET if the user already exists.
This introduces more network requests so I'd prefer to avoid this.
I noticed that there is some common solution to use 'email' as resource identifier.
This works for me. One remark is that I do not particularly like to use an email address in the url, but in my case it is okay as this url will only be visible within the cluster, and is not exposed to the outside network.

Prevent Browser Password Caching After Validation Of POST Parameters

How would one solve this?
An application has a form with a password and other input fields. The user must enter their password in order to submit a transaction along with other transaction info. The password is required as a security check at point of transaction submission.
The form input values are bound to a command object.
This was the way our application was handling this:
void submitAction(FooCommand command){
if(command.hasErrors()){
render(view: ‘show’, model: [command:command])
}
//else do save and redirect
}
We became aware that by using render instead of redirect, the user’s password was visible in the browser cache after user logs out. The URL used in the render is the same as the POST URL. After the user logs out, someone else could use the browser back button and resubmit the form while using a tool like firebug to inspect the POST parameters and gain access to the user's password.
There is also a requirement to persist the user’s input from the form back to the page that displays the validation errors. So a simple redirect with error message in the flash would fail this requirement.
The proposed solution is to use the chain method to put the
command object into the flash scope so a redirect is possible to display errors and user input. This prevents someone from accessing the POST URL, and thus the password, in browser tools.
void submitAction(FooCommand command){
if(command.hasErrors()){
chain(action: ‘show’, model: [command:command])//redirect instead of render
}
//else do save and redirect
}
One potential downside is storing command objects in the flash scope (ultimately the session) that might have eagerly fetched relationships in the command. Could storing command objects in the session affect performance?
Is there a better solution?
To prevent showing a page after logout when someone hits the back button, use the following response header:
Cache-Control: no-store, must-revalidate
Chain sounds like the way to go. You don't need to use Hibernate/JPA entities for your models, you could make a class specific to the form and copy to your entities. This might take less memory, though you're not likely to store it for too long using a flash map.

GET vs. POST in Session Validation

So I just read this article by Jeff Atwood and I wanted to make sure I understand it correctly as to how it applies to my use case. I am trying to validate a session for silent login. For security purposes this should be done with a POST right? Does it matter? I am just passing the sessionID and username from the cookie.
When it comes to CSRF (Cross-site request forgery), you can cause a user to take any action on any site which they are logged in to provided that the action requires only a GET. Forcing this to be done over a POST request defeats the approach of embedding an image, script tag, whatever in another page.
Even POST isn't completely secure in this scenario. There are other ways to mount a CSRF attack on a site using POST. Clickjacking/UI-Redressing enables another site to trick a user into submitting a form to a different website.
Basically the best way to validate is to add an automatically generated, hidden form element. You can store this inside your session data (Example: $_SESSION for PHP) so that you only need to generate a token at the start of a session. Of course, an attack could try do something like clickjacking (mentioned above) in combination with a iframe pointing directly to your site and possibly some JS to hide things a little.
For anything important you should re-prompt the user for their password, thereby greatly diminishing the value of any successful CSRF attacks.

sfGuard token login for wkhtmltopdf

wkhtmltopdf allows to make a screenshot of a browser view with a webkit browser.
I have a Symfony 1.4 application that requires login, which I would like to use wkhtmltopdf to create a "print this page" function.
How can I securely facilitate this. I'm thinking of creating a one-off token on each screen for the print button that allows wkhtmltopdf to login without using the password of the user.
Any suggestions for how to structure this?
We'vbe come to the conclusion to use the built in "keep me logged in" functionality for this problem.
Would you consider a different printing framework ?
What about jquery plugin (e.g. https://github.com/ianoxley/jqueryprintpage#readme) ?
That way you won't have to allow access to the restricted area from outside the session.
If you still want to use wkhtmltopdf, you can easily create an action that receives a url and a user_id and creates a unique token, I might save this token in your DB or in a Key-Value cache (depends what is your system architecture). I wouldn't create the unique token in advance, I think its better creating it on demand (When your user is asking a print).
You have couple of options in order to enable printing in secured actions,
1) Create a custom security filter. In the filter, in addition to authenticated request, you have to allow requests that contain "token" parameter with right combination of url and user
2) Change the action to unsecured. If you don't want the change the security filter, you would have to change each action to "unsecured" and create a function that verifies if either the request is authenticated or it has a proper token parameter.
It would be smart to remove each token after you used it once to make it even harder to guess a token.
In addition you might want to create a periodic worker that clears old tokens that were never in use.
Even though you already decided on an approach, I would still like to add one more alternate option that might help others viewing this issue.
Another alternate route might be to grab the current source of the page being viewed and post that into your printer backend using something like
$.post("/printer", document.documentElement.outerHTML);
This way you can also preprocess the HTML in an easy way. Your backed could first store the HTML and then parse it to for example convert images or perhaps remove some parts of the page that will not be used when printing.

Resources