Spidy has asked for the wisdom of the Perl Monks concerning the following question:

Hello Fellow Monks,
I'm writing a script, and it's becoming evident that we need to protect it against attacks based on the hidden form fields it's using. One method we've thought of is to make sure that all requests for the script are only coming from the server that it's hosted on, but I'm not sure exactly how I'd do this. Does anyone know how, or could point me to some documentation that might explain how?

Thanks,
Spidy
My Website
Get Eated!

Replies are listed 'Best First'.
Re: Checking Referring Page?
by ikegami (Patriarch) on Dec 07, 2005 at 17:43 UTC

    You could add an extra field consisting of an encrypted* checksum of the existing fields. This will allow you to detect tampering and that data came from your own script since only your script knows the key used to encrypt and decrypt the checksum.

    Alternatively (and more commonly used), you could store a session id instead of the data in the hidden fields. On the downside, this requires some sort of database to hold the data associated with the session. The security in this method comes from the near impossibility** of guessing the long session ids of active sessions.

    * – A symetric encrpytion algorithm, such as Crypt::Rijndael, would be ideal.

    ** – If you're using 128 bit session ids, and there are 1024 (210) active sessions on your site, the attacker has a 1 in 3.3*1035 (2(128-10)) chance of guessing an active session id.

[reply]
Re: Checking Referring Page?
by marto (Cardinal) on Dec 07, 2005 at 17:27 UTC
    Hi Spidy,

    If you check the $ENV{HTTP_REFERER} you can see where the requests are coming from.

    Hope this helps.

    Martin
[reply]
[d/l]
      No good. The referrer can be faked as easily as the hidden fields.
[reply]
      The Referer is completely client-dependant in if it's sent, what it sends etc. You shouldn't trust user input if you have to be sure of something.

      edit: Woops, this should've been an answer to marto.
      Ordinary morality is for ordinary people. -- Aleister Crowley

      Reparented from Checking Referring Page? by Arunbear

[reply]
      Apparently my server doesn't do $ENV{HTTP_REFERER}...can't seem to find it in my %ENV test, anyways.
      My Website
      Get Eated!
[reply]

        Don't forget there is no referrer if you're loading a page directly. You have to have clicked through something. Try putting a dummy link to stay in your CGI and see.

        use CGI qw(:standard);
print header(), start_html(); # <-- update to run/test w/o changes
print a({-href=>url(1)},
        "self-check: ",
        referer() || 'no referrer');

        [download]
[reply]
[d/l]

Back to Seekers of Perl Wisdom