Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have come across a website, freshbooks.com, which uses base64 encoded urls for all purposes, ranging from POSTing sensitive data to a URI or just viewing some resource.

For instance, a url to view an invoice on the website is (some part of url omitted for clarity):

something.fresbooks.com/dmlld0ludm9pY2VGQjU1Mzc2

When the string dmlld0ludm9pY2VGQjU1Mzc2 is decoded it gives viewInvoiceFB55376

Are there any reasons from security point of view to use URL in such format or just for some programming convenience. The only reason I can think is to prevent some automated tools to extract information about website design. If so, isn't this approach be characterized as security by obscurity?

share|improve this question

3 Answers 3

up vote 3 down vote accepted

There's absolutely no security gain from using this method of presenting the URLs. This is just a silly way of making the website "production-ready" (whatever that means). In fact, it's not even a programming convenience; it's the exact opposite. It makes debugging much more difficult especially when you have to find a specific string in a URL in the log files.

The developers of that site might have opted to make the website appear more secure by having cryptic URLs and whatnot. However, that doesn't mean this is security by obscurity.

If their website is vulnerable to SQL injection and they try to hide that by encoding the URLs, then it's security by obscurity. If their website is well secured against SQL injection; XSS; CSRF; etc., and they deiced to encode the URLs like that, then it's just plain stupidity.

Note: I've heard people argue that encoding the URLs might hide certain information from shoulder-surfers, or that it can help reduce crawling, or any number of arguments of that sort. I still find this technique silly for the reasons I mentioned above.

share|improve this answer

Base64 can be useful for passing data in URLs when that data includes non-url friendly characters, although even then, there are options.

The structure of what you have decoded actually seems to suggest that the encoded string is a command with parameters, which could suggest an reliance of Base64 for Injection attacks, like @Adnan said.

My best guess is that it's a misguided attempt at strengthening security.

share|improve this answer

HTTP URLs may be Base64 encoded not for security reasons, but for application reasons, specific to that web server.

I'll draw upon my experience with ASP.NET MVC which may or may not apply to your situation.

It is perfectly reasonable, although not user friendly, to encode data that may be mis-interpreted by the browser, or an MVC framework. Base64 works when UrlEncoding doesn't. For example, I have a / character I want to send to another server as a payload www.server.com/invoice.aspx?filehash=somedata1293/323222, Base64 encoding, or HTTP POST, is the only way to send the value of filehash in ASP.NET MVC without custom routes.

If I want to GET that data, then I would have to Base64 encode it.

Even though there are better solutions, I've seen this approach taken in internationalized applications supporting different character sets.

It is a bad idea, however, to consider Base64 encoding as a security measure since at most it will make casual URL "hacking" slightly more challenging for the novice. And yes, in this case it would be security by obscurity.

share|improve this answer
    
Or, maybe, filehash=somedata1293%2F323222. Just like URL encoding was meant to be used. Alternative, UTF-8 can be used to comply with the newer RFC 3986. I've seen Base64 used so many times and not one time there was one logical reason for the usage. Your answer is not different. –  Adnan Dec 3 '13 at 16:00
    
@Adnan Perhaps this is a platform issue, specific to ASP.NET MVC? My test website seems to interpret encoded urls as the incorrect route. e.g. append the encoded version of ?callback=http://host.com/test –  makerofthings7 Dec 3 '13 at 16:03
    
Thanks for your suggestion. Still, the main point of the question is the security aspect. –  Adnan Dec 3 '13 at 16:18
    
Exactly... my point is that it may not be a security issue at all, though it's easy to assume that all reasons things are done are security related when viewed in the context of this site. –  makerofthings7 Dec 3 '13 at 16:25
    
You can always apply HMAC to provide authenticity and integrity of Base64 encoded data in URL. –  Matrix Dec 4 '13 at 8:37

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.