You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Tim Wood <ti...@pacbell.net> on 2004/02/06 22:30:45 UTC
Re: [users@httpd] do I have access to the user id used in
basic authentication?
At 11:37 AM 02/06/04, Geoffrey wrote:
>>><input type="hidden" name="userid" value="esoteric">
>>
>>Woh. This is terribly insecure and should only be used if you don't
>>really care what userid the cgi script sees. The user could bypass
>>your html page and supply any userid it wants to the cgi script.
>
>The cgi script is protected by the basic auth as well.
>
>The user id is mapped to other data one to many relationship, so it's really not going to get them much.
>
>I don't really see how it is insecure. You can't get to that page without entering the userid/password in the pop up. If you do, then you already know what is going to be there.
Another hole is that if the server uses the <input>ted username to determine authorization, one could log in as user A then POST user B's name to the CGI and run with B's privileges. If the inputted username is informational only, get rid of it and consult the authentication cookie, to avoid confusion like this.
>>To make this more secure, you should protect the cgi script itself with
>>basic auth and look at the REMOTE_USER env variable inside the cgi script.
>
>The cgi script that processes the page is protected by basic auth. All this id gets a person is access to read only data. None of the ids are real machine ids.
>
>Further, the data is not protected by ssl as it's not considered necessary.
The risk is that valuable data will someday be placed behind the weak/confused security mechanism.
TW
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] do I have access to the user id used in basic
authentication?
Posted by Geoffrey <es...@3times25.net>.
Tim Wood wrote:
> At 06:20 PM 02/06/04, you wrote:
>
>
>> You'd have to understand the purpose. First, it's likely
>> impossible that user A could guess user B's id.
>
>
> Unless user A knows user B.
They don't. Doesn't matter. A isn't interested in B's data. Trust me.
>
>> There's no privileges. It's presenting them read only data. It's
>> not a big deal if A see's B's data. The main idea is to restrict
>> access to folks who have ids and to use the id to determine what
>> data they see.
They don't know each other.
> But if it's no big deal if A sees "B's" data, then why consult the
> ID? It looks like user preference is confused with security here.
How else do I select user A data for user A? I must know who's logging in.
> Just because data is read-only doesn't mean it's not sensitive. (Can
> I read your credit card nos.? Pleeeease? :)
You'll have to assume I know my data. As I said, if it was sensitive,
I'd not be using basic auth, and I'd used SSL.
I'll tell you that a credit union I belong to tried using the last for
digits of members ssn published on a website for a contest. I raised
holy hell with them on that. I don't want any part of my ssn published
anywhere. You don't know the data involved here, thus you'll just have
to assume I do.
>> You'd have to understand the purpose of the report. The purpose
>> behind the auth. is to keep people out who don't have an id.
>> Further, use the id to determine what data to present.
>
>
> It is still confused to use a username to mean access rights
> (privileges). Logging in the user and determining what s/he can do
> are two different decisions.
Each user can do the same thing, view the data they are interested in.
That data is keyed to the id. In this case, the ability to log in
permits you to view data. The data you view is based on determining who
you are, your id.
--
Until later, Geoffrey Registered Linux User #108567
Building secure systems inspite of Microsoft
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] do I have access to the user id used in
basic authentication?
Posted by Tim Wood <ti...@pacbell.net>.
At 06:20 PM 02/06/04, you wrote:
>You'd have to understand the purpose. First, it's likely impossible that user A could guess user B's id.
Unless user A knows user B.
> There's no privileges. It's presenting them read only data. It's not a big deal if A see's B's data. The main idea is to restrict access to folks who have ids and to use the id to determine what data they see.
But if it's no big deal if A sees "B's" data, then why consult the ID? It looks like user preference is confused with security here. Just because data is read-only doesn't mean it's not sensitive. (Can I read your credit card nos.? Pleeeease? :)
>You'd have to understand the purpose of the report. The purpose behind the auth. is to keep people out who don't have an id. Further, use the id to determine what data to present.
It is still confused to use a username to mean access rights (privileges). Logging in the user and determining what s/he can do are two different decisions.
TW
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] do I have access to the user id used in basic
authentication?
Posted by Geoffrey <es...@3times25.net>.
Joshua Slive wrote:
> On Fri, 6 Feb 2004, Tim Wood wrote:
>
>>The cgi script that processes the page is protected by basic auth.
>
>
> Then why aren't you just looking at REMOTE_USER in the cgi rather than
> doing complicated SSI processing in the html?
Valid point, I'll look into that solution, thanks.
--
Until later, Geoffrey Registered Linux User #108567
Building secure systems inspite of Microsoft
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] do I have access to the user id used in basic
authentication?
Posted by Geoffrey <es...@3times25.net>.
Joshua Slive wrote:
> On Fri, 6 Feb 2004, Tim Wood wrote:
>
>>The cgi script that processes the page is protected by basic auth.
>
>
> Then why aren't you just looking at REMOTE_USER in the cgi rather than
> doing complicated SSI processing in the html?
What a duh? moment. Moved the REMOTE_USER to the perl script and all is
wonderful. Thanks to you and Mr. Wood for prodding me to make this more
secure.
--
Until later, Geoffrey Registered Linux User #108567
Building secure systems inspite of Microsoft
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] do I have access to the user id used in basic
authentication?
Posted by Joshua Slive <jo...@slive.ca>.
On Fri, 6 Feb 2004, Tim Wood wrote:
>The cgi script that processes the page is protected by basic auth.
Then why aren't you just looking at REMOTE_USER in the cgi rather than
doing complicated SSI processing in the html?
Joshua.
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] do I have access to the user id used in basic
authentication?
Posted by Geoffrey <es...@3times25.net>.
Tim Wood wrote:
> At 11:37 AM 02/06/04, Geoffrey wrote:
>
>
>
>>>> <input type="hidden" name="userid" value="esoteric">
>>>
>>> Woh. This is terribly insecure and should only be used if you
>>> don't really care what userid the cgi script sees. The user
>>> could bypass your html page and supply any userid it wants to the
>>> cgi script.
>>
>> The cgi script is protected by the basic auth as well.
>>
>> The user id is mapped to other data one to many relationship, so
>> it's really not going to get them much.
>>
>> I don't really see how it is insecure. You can't get to that page
>> without entering the userid/password in the pop up. If you do,
>> then you already know what is going to be there.
>
>
> Another hole is that if the server uses the <input>ted username to
> determine authorization, one could log in as user A then POST user
> B's name to the CGI and run with B's privileges. If the inputted
> username is informational only, get rid of it and consult the
> authentication cookie, to avoid confusion like this.
You'd have to understand the purpose. First, it's likely impossible
that user A could guess user B's id. There's no privileges. It's
presenting them read only data. It's not a big deal if A see's B's
data. The main idea is to restrict access to folks who have ids and to
use the id to determine what data they see.
>>> To make this more secure, you should protect the cgi script
>>> itself with basic auth and look at the REMOTE_USER env variable
>>> inside the cgi script.
>>
>> The cgi script that processes the page is protected by basic auth.
>> All this id gets a person is access to read only data. None of the
>> ids are real machine ids.
>>
>> Further, the data is not protected by ssl as it's not considered
>> necessary.
>
>
> The risk is that valuable data will someday be placed behind the
> weak/confused security mechanism.
You'd have to understand the purpose of the report. The purpose behind
the auth. is to keep people out who don't have an id. Further, use the
id to determine what data to present.
If the data were valuable, I would not be using basic auth.
--
Until later, Geoffrey Registered Linux User #108567
Building secure systems inspite of Microsoft
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org