2

I am about to launch a eCommerce platform where users have their own shop URL based on the username IE my username on stack is NoobSkie so I would access my shop at

www.example.com/noobskie/shop

Is there any thing that could go wrong with this setup with people trying to manipulate URL's?

  • 3
    strings are not a threat - what you do with those strings can be a threat ... – schroeder Apr 24 '17 at 9:59
2

It depends on the validation that is in place regarding the username.

If you already

  • whitelist the characters in the username to alphanumeric only
  • restrict the maximum size of the usernames
  • ensure username unicity
  • ensure that no username can match existing url's (depends on your site, maybe this is not needed.. It is if you have for example something like /default/shop or /welcome/shop)

, I don't see much of a risk :)

  • Along with the username validation, same or similar validation should be in place when parsing the URL before doing anything with the string especially database lookups. – Marko Vodopija Apr 24 '17 at 10:12
  • This was my hunch originally I was looking into facebooks username's and it's along the same lines – NooBskie Apr 25 '17 at 7:15
2

Do you let users customise their shop? If they can edit HTML they may be able to include JavaScript, which would allow a cross-site scripting attack. Because of this, many services instead have URLs like: http://noobskie.example.com/

2

Since Let's Encrypt lets server admins validate the domain using a /.well-known/acme-challenge endpoint, a malicious user could register a username .well-known and set up a shop with the name acme-challenge.

It is impossible to know all validation mechanisms out there, so I would opt for the solution already proposed by @paj28, which is to give users a URL in the form of $username.example.com.

1

Make sure that people can't commit identity theft using your system or create spoof accounts. What I mean is something like

example.com/amazon

People might use third party brand names for example. This is unlawful in many countries and can get you in trouble accordingly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.