3 ms·
This is just dangerous. Example. If news.ycombinator.com implemented this dual cookie method. A man in the middle could intercept the page I'm looking at now, w
by mike-cardwell 16y ago
This is just dangerous. Example. If news.ycombinator.com implemented this dual cookie method. A man in the middle could intercept the page I'm looking at now, where I'm entering this comment in a textarea. They could modify the underlying form to post to the same page as the update form on the profile page, and set a hidden email field. Then when I hit the "reply" button, even though I'm posting to a HTTPS page, I'm not posting to the one I think I am, because the page containing the form it's self wasn't protected by HTTP.
I hope I explained that well enough. Mixed content is hard to do right. Forcing every page over SSL prevents anyone making any modifications to any page, and is just inherently safer.
- mapgrep 16y agoWait, if you've got the capability to intercept and rewrite arbitrary http forms, couldn't you just rewrite the homepage of Google.com the same way? The "action" attribute on the form gets changed to https -mybank- dot com slash profile, hidden fields are inserted, etc, and when the user clicks "Search" he's actually updating aforementioned profile page. If this is possible, then the dual cookie method would seem to make sense.
- mike-cardwell 16y agoTrue, as long as the site isn't doing referer checks, which most of them probably aren't. This is yet another argument for why the entire web should be secured with SSL.
- rimantas 16y agoThis is all true but it is somehow different from the topic: one cannot do this kind of attack easily just using Firesheep kind of tool. I think sometimes these discussions are carried away to far.
- al_james 16y agoWell, I would say its not 'just as dangerous' as a man in the middle attack is harder to set up. Good point though. Maybe this could be solved by including a unique access code with the form that is a hashed value of the user'id and the url that you are submitting to (with salting to make this unguessable). Simply check this value upon submission to make sure it matches the URL seen by the controller. That would prevent anyone rewriting a form to submit to a new endpoint.
- iampims 16y agoIsn't it why we need to implement xsrf protection on every form?
- mike-cardwell 16y agoCSRF protection should be implemented even if your entire site is protected by SSL. Also, I didn't say "just as dangerous", I said "just dangerous"
- al_james 16y agoSorry for misquoting you. However, with proper CSRF protection your man in the middle argument is not the case is it?