CPS 353: Internet Programming

Sessions and Security

Marcos Elugardo

Gordon College

Last Modified: 11/17/2015

Selected content adapted from material by Marty Stepp, Jessica Miller, and Victoria Kirst © 2012. Used by permission.

Agenda

Check-in

14.1: Cookie Basics

Stateful client/server interaction

amazon cookie

Sites like amazon.com seem to "know who I am." How do they do this? How does a client uniquely identify itself to a server, and how does the server provide specific content to each client?

What is a cookie?

om nom nom

How cookies are sent

cookie exchange

Myths about cookies

A "tracking cookie"

tracking cookie figure

Where are the cookies on my computer?

good enough for me

How long does a cookie exist?

14.2: Programming with Cookies

Cookies in JavaScript

document.cookie = "username=smith";   // setting two cookies
document.cookie = "password=12345";
document.cookie = "age=29; expires=Thu, 01-Jan-1970 00:00:01 GMT";  // deleting a cookie
...

// (later)
var allCookies = document.cookie.split(";");    // ["username=smith", "password=12345"]
for (var i = 0; i < allCookies.length; i++) {
	var eachCookie = allCookies[i].split("=");    // ["username", "smith"]
	var cookieName = eachCookie[0];               // "username"
	var cookieValue = eachCookie[1];              // "smith"
	...
}

Setting a cookie in asp.net

Response.Cookies["name"] =  "value";

Response.Cookies["UserSettings"]["Font"] = "Arial";
Response.Cookies["UserSettings"]["Color"] = "Blue";
Response.Cookies["UserSettings"].Expires = DateTime.Now.AddDays(1d);
  • technically, a cookie is just part of an HTTP header, and it could be set using ASP.Net's Header collection
    • 				Response.Headers.Add("UserSettings", "Font=Arial");

Retrieving information from a cookie

var variable = Request.Cookies["name"];   // retrieve value of the cookie

	if (Request.Cookies["UserSettings"] != null)
{
    string userSettings;
    if (Request.Cookies["UserSettings"]["Font"] != null)
    { 
		userSettings = Request.Cookies["UserSettings"]["Font"]; 
	}
}

Deleting a cookie

	if (Request.Cookies["UserSettings"] != null)
{
    HttpCookie myCookie = new HttpCookie("UserSettings");
    myCookie.Expires = DateTime.Now.AddDays(-1d);
    Response.Cookies.Add(myCookie);
}

14.3: Sessions

What is a session?

How sessions are established in ASP.NET

session

Sessions in ASP.Net: Session_OnStart Event

Session_OnStart();

Accessing session data in ASP.Net

Session["name"] = value;        # store session data
varvariable = Session["name"];     # read session data
if (Session["name"] != null) { } # check for session data

if (Session["points"] != null ) {
	points = Session["points"];
	
} else {
	Session["points"] = 0;  # default
}

Session timeout

Ending a session

Session.Abandon();

Session best practices

Implementing user logins

user login

"Remember Me" feature

user login

15.1: Security Principles

Our current view of security

group hug

The real world

orcs (dorks?)

Attackers' goals

burglar

Why would an attacker target my site?

Tools that attackers use

firebug

Assume that the attacker knows about web dev and has the same tools you have:

Some kinds of attacks

burglar

Information leakage

information leakage

when the attacker can look at data, files, etc. that he/she should not be allowed to see

15.2: Cross-Site Scripting (XSS)

Cross-site scripting (XSS)

a flaw where a user is able to inject and execute arbitrary JavaScript code in your page 

insecure.aspx?question=<script type='text/javascript'>alert('pwned');</script>

<h1>Your question is: @Request['question']</h1>
clippy

Securing against XSS

15.3: Validating Input Data

What is form validation?

A real form that uses validation

wamu

Client vs. server-side validation

Validation can be performed:

An example form to be validated

<form action="http://foo.com/foo.aspx" method="get">
	<div>
		City:  <input name="city" /> <br />
		State: <input name="state" size="2" maxlength="2" /> <br />
		ZIP:   <input name="zip" size="5" maxlength="5" /> <br />
		<input type="submit" />
	</div>
</form>

Basic server-side validation code

var city  = Request["city"];
var state = Request["state"];
var zip   = Request["zip"];
if ( String.IsNullOrEmpty(city) || String.IsNullOrEmpty(state)  || String.IsNullOrEmpty(zip) || state.Length != 2 || zip.Length != 5) {
	Console.WriteLine( "Error, invalid city/state/zip submitted.");
}

Regular expressions

/^[a-zA-Z_\-]+@(([a-zA-Z_\-])+\.)+[a-zA-Z]{2,4}$/

Regular expressions in JavaScript

Replacing text with regular expressions

15.4: SQL Injection

SQL injection

grades

a flaw where the user is able to inject arbitrary SQL into your query

A SQL injection attack

Too true...

bobby tables xkcd comic

Securing against SQL injection

var username = Request["username"]).Replace("'","\'");
var password = Request["password"]).Replace("'","\'");
var query = "SELECT name, ssn, dob FROM users
WHERE username = $username AND password = $password";

Parameterized Queries

Injection attacks are not limited to SQL

15.5: Session-Based Attacks

Man-in-the-middle attack

man in the middle

when the attacker listens on your network and reads and/or modifies your data

Secure HTTP (HTTPS)

insecure communications
https

Session hijacking

firesheep

when the attacker gets a hold of your session ID and masquerades as you

Cross-Site Request Forgery (CSRF)

CSRF-ish

when the attacker tricks you into submitting a malicious request on their behalf

Defending against CSRF attacks

OWASP Top 10

OWASP (Open Web Application Security Project) provides tools and information to make software more secure.

  1. Injection
  2. Broken Authentication and Session Management
  3. Cross-Site Scripting (XSS)
  4. Insecure Direct Object References
  5. Security Misconfiguration
  6. Sensitive Data Exposure
  7. Missing Function Level Access Control
  8. Cross-Site Request Forgery (CSRF)
  9. Using Components with Known Vulnerabilities
  10. Unvalidated Redirects and Forwards

Secure Development Best Practices

Secure software development from a Christian perspective

Homework 7