Hello,
Despite of my 10 years experience working as .Net Developer, I never heard or thought about the needs to validate return url when we are about to login. Ex.: http://SomeSite.com/Account/LogOn?returnUrl=MyAccount. But is better late than never..
Without validation the return url can be attacked:
1- Sending email with advertising about the company
2- Changing the return url: http://SomeSite.com/Account/LogOn?returnUrl=www.MyAccountFake.com.
3- After successful login, the user will expect to be in one page but will be in a complete different page!
This kind of attack is called Open Redirection Attacks. For more, please visit this link: http://www.asp.net/mvc/tutorials/security/preventing-open-redirection-attacks
Basically, we should check if the return url is under our domain.
Cheers, Adilson
Despite of my 10 years experience working as .Net Developer, I never heard or thought about the needs to validate return url when we are about to login. Ex.: http://SomeSite.com/Account/LogOn?returnUrl=MyAccount. But is better late than never..
Without validation the return url can be attacked:
1- Sending email with advertising about the company
2- Changing the return url: http://SomeSite.com/Account/LogOn?returnUrl=www.MyAccountFake.com.
3- After successful login, the user will expect to be in one page but will be in a complete different page!
This kind of attack is called Open Redirection Attacks. For more, please visit this link: http://www.asp.net/mvc/tutorials/security/preventing-open-redirection-attacks
Basically, we should check if the return url is under our domain.
Cheers, Adilson
Sem comentários:
Enviar um comentário