I have an ASP.NET MVC website that is using Identity for authentication. It runs in IIS 8.5 as HTTP but has SSL terminated at the Load Balancer and is HTTPS for everything between the browser and the Load Balancer.

Here are the certificate details:

enter image description here

My website does an AJAX POST request to a controller action and the controller action returns a JSON response containing a NavigateUrl property. The JavaScript then sets the window.location.href to the value of this property.

Is it possible for this value to be manipulated so that a user of the website can be redirected to a different URL without their knowledge?

  • 1
    Unfortunately, we do not do code reviews. – schroeder Dec 1 '15 at 19:55
  • Ignoring the code then, is it safe to redirect to a URL returned from a web service if the communication is via HTTPS? Can the URL be changed by a MITM without the user knowing? – Anthony Dec 1 '15 at 20:03
  • Yes, it can be changed if the certificates are compromised. – orique Dec 1 '15 at 22:11
  • @orique that's true - but the browser would show a warning in that instance and the user would know something is wrong. – Anthony Dec 1 '15 at 22:22
  • @Anthony unless you have a Dell :) – orique Dec 1 '15 at 22:36

There is nothing especially dangerous about the redirect. If someone can modify the URL, they can likely modify any data in the response. That is, your site is totally compromised already.

I would make sure that your web app is generally secure (eg: follows OWASP Top-10). A defense-in-depth security philosophy suggests that you might want to use SSL between the load balancer and app servers.


Two problems you might of a general nature (not specific to this issue are):

  1. Browsers with a surplus of questionable root CAs can easily be MITMed.
  2. HTML and JS code injection holes in your site can cause untrustworthy links to be sent through your trusted SSL pipe.
  • If #1 is true then there is no security using that browser for any site, not specific to this site. If #2 is true then the site is vulnerable in general. Neither of these reasons are specific to the question. – Neil Smithline Dec 2 '15 at 1:55
  • "Is it possible for this value to be manipulated so that a user of the website can be redirected to a different URL without their knowledge?" Yes, in the ways suggested. – Andrew Philips Dec 2 '15 at 1:58
  • 1
    OK. I see what you're saying. I think the answer would be better with a sentence or two stating that what you state are general problems and not specific to the URL or something with the configuration. – Neil Smithline Dec 2 '15 at 2:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.