Lazycoder

member variable values in the querystring == security risk?

There is a lot of emphasis in the web development world on making urls “pretty” and, more importantly, discoverable. While there isn’t anything wrong with wanting urls that human beings can read and understand, web developers need to understand that the querystring is an entry point into your application if you are passing values in it and therefore is an attack vector.

So, say you have a querystring that looks something like this.

http://lazycoder.com/people/delete/1242

What does 1242 stand for? Why are you passing it in the query string? What happens to the value when it gets assigned to a variable inside your code? Are you sure you have all of your authorization checks in place to make sure that the currently logged in user has permission to edit whatever 1242 represents? The W3C mentions not including sensitive data in the querystring.

Authors of services which use the HTTP protocol SHOULD NOT use GET based forms for the submission of sensitive data, because this will cause this data to be encoded in the Request-URI. Many existing servers, proxies, and user agents will log the request URI in some place where it might be visible to third parties. Servers can use POST-based form submission instead.

I personally get itchy anytime I see PK values in a web interface. It means if an attacker does somehow gain access to my database, they already know a PK value and could possibly pass it in through a security hole.

Encoding or encrypting the values before putting them into the querystring doesn’t completely solve the problem. In fact, it makes the URL ugly again.

What I would suggest is this:

1. Encrypt sensitive values (userID, values used in edit/delete actions)
2. Place those values in hidden form fields. These can be created on the fly if needed
3. Only pass sensitive values using a POST verb.
4. Include a secure site/session token in a hidden form to help foil cross-site attacks.

Ideally, I’d like some way in the framework to mark variables as “secure” to prevent any part of the framework from putting them in the querystring. Perhaps raise some kind of warning.

My point isn’t to indict pretty URLs, it’s just to raise awareness of the querystring and it’s potential security risks.

There are also other possible problems with passing params in the querystring. They mainly involve changing data on the server. The W3C explicitly states that HTTP GET is only to be used when no data will be changed on the server.

GET considered harmful.
Get Considered Harmful; Sometimes.
Securing forms with POST isn’t enough