0

I have an angularJS $http.post that sends username/password to a PHP file that then queries my database to verify a successful log in. I then return a JSON object back to angularJS in one of the formats below:

{'success' : 'true', 'userFirstName' : [firstNameFromDatabaseQuery]}

or

{'success' : 'false'}

Once back in angularJS, I check the value of success to determine if the user's credentials were valid, and log in the user if so.

To my question - can this JSON response from PHP be modified by a user to mark their log in as successful, by changing success to 'true'?

I feel it is worth mentioning that I chose this way over using PHP session variables because it was not working well in my angular application, and it also seems to be a lot cleaner code. Additionally, this is a very simple application. No significant personal information will be involved, such as SSNs or bank/credit card info.

Improve this question
6
  • Why would users want to do that? They still won't be logged in on server side.
    – Dmitry Grigoryev
    Commented Dec 9, 2015 at 15:06
  • @DmitryGrigoryev The reason I asked is because I have not set up server-side validation yet. Since this application doesn't need to be overly secure (not much information to protect outside of passwords) I was curious if this would be ample enough. If the user can modify this response though, then I will indeed need to add a bit of server-side authentication as well.
    – Tricky12
    Commented Dec 9, 2015 at 15:35
  • Client side "security" is really just UI work. If you're actually looking for security, it must be done on the server.
    – Neil Smithline
    Commented Dec 9, 2015 at 19:59
  • @NeilSmithline The problem I am having is that even if I do my authentication on the server, in PHP, I can't get the value back to angularJS in a way that I know for certain it hasn't been modified by the user. I'm having trouble getting $_SESSION variables to angularJS, and it appears that responses to an $http.post can be modified by a user.
    – Tricky12
    Commented Dec 10, 2015 at 15:16
  • Tricky, you cannot send any code or data to the user unless they have permission to access it. So it won't matter if they change the response data because they can't access more than they have.
    – Neil Smithline
    Commented Dec 10, 2015 at 15:21

1 Answer 1

Reset to default
1

Yes, the client could modify the PHP to change the value of success to true. However, it depends on your application logic to determine if that has any security consequences on your application. If the application just uses the success value to load a new UI, but can't pull down any data (because the user doesn't have an authentication cookie, or some other authorization token), then it wouldn't really be a concern.

However, if future requests (say, change password), use the userFirstName as the mechanism of authentication (that is, the back end PHP sees the first name and based only on that) then the application could not only be spoofed by changing success=true but also by setting userFirstName any attacker could become any other person if they know their first name.

Instead, you would return an authentication cookie of some kind. This would most likely be a random session ID that is sent with every future request. The backend PHP would then validate the session ID, and from it, know who the user is that is making the request.

This post has some ideas as to how to use authentication in angularjs applications.

Improve this answer
2
  • So if a user can modify the value I return from my PHP file to my anguarJS $http.post function (including a token), and I can't access PHP $_SESSION variables inside angularJS, then how would I be able to use a token in this scenario?
    – Tricky12
    Commented Dec 10, 2015 at 15:14
  • I'm not sure what you mean by "I can't access PHP $_SESSION variables inside angular JS". Of course angular won't be able to do something like $_SESSION['username'], because that data is stored on the server. However, whenever you start a PHP session, a cookie is stored on the browser that contains a PHP Session ID. On the next request, the browser submits that cookie and the server populates $_SESSION. So if you need the data from SESSION, you can return those fields, but you can't use them for authentication.
    – amccormack
    Commented Dec 10, 2015 at 15:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .