Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have a client that wants to protect access to a web app in case the employee leaves because the app gives access to clients, sales, etc. He wants to "hide" the login credentials to this app and asked us to write a login app that would need to be launched first, then the app would log the user in. This way the user would never know their true credentials and they could not have remote access to this app on weekend. Anyone have done this or have ideas?

share|improve this question
    
apache + client certs: be sure to have the root-ca NOT on the webserver, a strong root-ca-pw and regulary root-ca-backups. btw, isnt your solution security-by-obscurity? doesnt the login-credentials have to be stored within the app? –  that guy from over there Aug 31 '13 at 16:08

1 Answer 1

I suppose that your problem is about using a Web application that you do not control. That Web application requires some "user credentials" (login and password) which you do not want to show to the human user. But these credentials must exist, and if they are not in the employee's head, then they must be in his machine or another relay machine.

In general, you can envision a proxy system: the employee connects not to the Web app, but to the proxy. The employee authenticates with the proxy through some proxy-specific method, which can be a login+password (not the same as the credentials for the Web app). The proxy then forwards all requests to the Web app, and responses back, except that it also performs the "true" authentication with the Web app.

That proxy can be some software running on the employee's desktop system, but that's kinda weak, because the employee has, by definition, physical access to his own desktop system, so he will be able to extract whatever secrets it contains, if he puts some effort into the task. A stronger system is to make the proxy a separate machine, kept in a bay in a server room, on the company internal network. The point here being that this proxy machine is not reachable by the employee from his home Internet access.

That's about as much as we can tell "in general". How easy or hard it would be to implement such a system depends a lot on how the Web app does things. For instance, if the target Web app uses HTTP Basic Authentication, then the proxy just has to transparently add a WWW-Authenticate: HTTP header to every request. If the Web app uses a custom "login page" (that's the usual case), then the proxy would have to get that page, submit the credentials (HTTP POST), then get the HTTP cookie, and add the Cookie: HTTP header to every request. If the Web app uses OAuth, and/or Ajax code with client-side Javascript, then things can become complex, possibly quite hairy.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.