As a self-taught discovering professional development, I daily run into things that puzzles me.

Simply put: I'm supposed to work on an old ZF1 application (with really ugly code, imbricated ternaries, condition inside assignation and stuffs without comments), but since Friday I didn't start anyway work because... I can't find out how to successfully "authentify the application" ! The application makes a SOAP call to the "portal", passing it a truncated version from the HTTP_HOST, which is then checked for its presence in a database. The corresponding row basically is made of domain names without subdomains, a plain text password, and a serialized array which is returned to the application.

If it fails, it throws an exception with message "110" (meaningful huh), nothing catches it so : fatal error.

As far as I understand what my boss says (I'm self-taught on english websites and books, he's not really a dev neither an architect or en english speaker, so dialog may get strange) : "this is to secure the application, so that nobody would be able to use our code to fake our application through a similar domain as our". Although I try to keep myself as much informed as possible, my knowledge about security isn't enough to answer myself... But I feel like their security is totally useless !! If they "use their code" it's because bad guys had access to it... so to the server... and nonetheless, if I get the code, I just need to get rid of the authentication process... or fake their domain name when doing the SOAP call... I can simply reproduce...

Does that even make sense ?? Isn't requests over SSL/TLS way more secure that this kind of makeshift job ??

Bonus question : what's the point in responding with a "Welcome to nowhere" 200 code instead of a 503 or anything else when requesting the server IP ?? Excepted telling bad guys "HEY, here's nowhere, but there's still something behind !!"

Thank you !


I think what the boss is trying to say by

so that nobody would be able to use our code to fake our application through a similar domain as our

is that they don't want anybody else to make a different client for their application. They have a database of trusted clients for their webservers and they would honor requests made only from those addresses.
This idea of white-listing clients is an old one but their implementation is definitely flawed. Anybody can spoof the HTTP_POST parameters that they are looking for and make whatever SOAP calls they want.
This discussion (though not completely the same as what your boss wants), can help you out: Best practices for securing open APIs from quota theft

  • Yeah it's lik if the StackExchange web application authentify itself against a StackExchange DB to certify on each request that the user is accessing it through "stackexchange.com"... As I thought and you comfort me in : HTTP requests may be spoofed (although I don't see why I would do that excepted spamming... I would never get the answer !)... Once user are logged in... THEY are authentified... When they are not, they only access the index page... From there, they can't do no harm I'm protected from with the white-listing... Eeh, thank you, you comfort me in my thoughts... – Shirraz Jul 25 '16 at 13:37
  • Actually @QuentinBonaventure you can write an entire new client and then snoop whatever data you get. So even after the user is authenticated, the whitelisting doesn't protect you. Feel free to upvote the answer if it helped :) – Limit Jul 25 '16 at 14:06
  • 1
    it helped, but I need 15 pts to upvote... Will check it most helpful, and upvote if allowed too... Or will asap ! ;) Oh and yep, that's was my first thought... That we don't even need backend code at all, simply the frontend to imitate... And frontend code being public by nature... – Shirraz Jul 25 '16 at 15:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.