Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have 2 portals(both are under my control & domain names are different)

In 1st portal, there is a link on click of which User can directly get logged into 2nd portal.

Link which will be hit in 1st portal to log into 2nd portal looks like below(Its a GET)

https://SecondPortalDomain/someServlet?param1=base64Encoded

This URL has problems like it can be cached and bookmarked. Also, if a User doesn't get authenticated to my 1st Portal, but hits above URL directly then also he can login (against my wish).

So, am thinking of putting a check using Referer. If source URL is so and so then only allow to login.

How strong is using Referer compared to validating checksum between source and target? Referer is a client-controlled value and can thus be spoofed to something entirely different or even removed. But, even a checksum value can be studied and spoofed.

share|improve this question

3 Answers 3

up vote 1 down vote accepted

You're right that the referrer header can easily be spoofed or be completely missing. There are browser plugins that block the sending of the referrer, so if you add a check on the referrer, you would be stopping users with those plugins from using your site.

A better option would be for the first portal to generate a long random token for each user, and somehow share that token with the second portal. Then portal 1 shows the user a link that includes the token as a parameter, for example https://SecondPortalDomain/someServlet?token=13a82b00-b17e-11e2-9e96-0800200c9a66. You have plenty of options for how the portals could share the token - for example they might share a database, or portal 1 could send it to portal 2 via SOAP or a RESTful post.

If this option doesn't work for you, then another alternative would be to do something time based. Portal 1 could encrypt the current time and use it as the token in a link to portal 2. Then portal 2 would decrypt it, and check whether the time from the token was within the last 10 minutes (or whatever tolerance you want).

share|improve this answer

Don't trust referrers at all. As you've rightly pointed out they can be easily spoofed and are therefore laughable as a 'security measure'.

Implement some kind of single-sign-on mechanism between the two portals. A simple solution such as a time restricted token would be highly recommended for this kind of functionality.

If your portals share common infrastructure or application services, SSO features are available in many of the popular application platforms, http://www.jboss.org/jbosssso or http://www-10.lotus.com/ldd/portalwiki.nsf/dx/Setting_up_single_sign-on_for_WebSphere_Application_Server for an example.

share|improve this answer

Generally speaking ,, Do not trust Any Thing (headers, hidden form, validation, etc..) that depend on the browser(client side)

use burpsuite , WebScarab or any other proxy to intercept your request, you'll see how dangerous is it.

You can imagine that if your authorization depends on "referer" and user change the refere to the valid one during browsing, he will get authorized which is not what you looking for.

simple rule? the user is your enemy.

This link is useful - (OWASP)

https://www.owasp.org/index.php/OWASP_Secure_Coding_Practices_-_Quick_Reference_Guide

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.