Re: put in safety my Rest Web Services

If you are going to the bother of insisting on a user id and password bring passed then wouldn't it be normal to have those credentials (encoded) in the HTTP header (not in a query string or post data)?

Sent from my iPad

On 18 Aug 2015, at 21:41, Pete Helgren <pete@xxxxxxxxxx> wrote:

Henrik,

This is where I plan to go and don't know if this is what the OP was concerned about. What I don't want to have happen is that the http://serverip/getinfo.pgm?userid=aaaaa&password=bbbbb&account=123456 is changed to http://serverip/getinfo.pgm?userid=aaaaa&password=bbbbb&account=654321 and they are given account access to that account. Yeah, I could check to make sure that the account is valid for that user, plus a few other steps, but hashing and salting are a bit more straightforward and require fewer steps (IMHO)...

Pete Helgren
www.petesworkshop.com
GIAC Secure Software Programmer-Java

On 8/18/2015 1:29 PM, Henrik Rützou wrote:
Richard

if you control both the client and the server it is quite simple.

Lets say you have a URL like


http:// serverip/getinfo.pgm?userid=aaaaa&password=bbbbb&account=123456


you change the url to


http:// serverip/getinfo.pgm?userid=aaaaa&hash=
4625fd63b0e96fc0d656ae7381605e48d4a0f63a319fc743adf22688613883c7&account=123456

Everybody can do a HASH - but the HASH is 'salted'

The user id aaaaa has a 'salt'-value only the client and the server knows
so the input
to the HASH algoritm is

aaaaa123456salt

There is no way you can break this security other than 'trail and error'
since you cant
deciber HASH values and the 'salt' is only known by the client and the
server.

--
This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) mailing list
To post a message email: WEB400@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/web400
or email: WEB400-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/web400.


___________________________________________
This email has been scanned by iomartcloud.
http://www.iomartcloud.com/

________________________________

NOTICE: The information in this electronic mail transmission is intended by CoralTree Systems Ltd for the use of the named individuals or entity to which it is directed and may contain information that is privileged or otherwise confidential. If you have received this electronic mail transmission in error, please delete it from your system without copying or forwarding it, and notify the sender of the error by reply email or by telephone, so that the sender's address records can be corrected.



--------------------------------------------------------------------------------


CoralTree Systems Limited
Company Registration Number 5021022.
Registered Office:
12-14 Carlton Place
Southampton
Hampshire
SO15 2EA
VAT Registration Number 834 1020 74.