2

So, we've got a fairly standard login page on a web application.

We want to make a slight change so that if a user gets their password wrong, the page reloads (as it currently does) but the username is kept so the user doesn't need to enter it again.

The easiest way for us to do this is just put the username in the querystring, and bind that to the username input.

Are there any risks associated with this approach?

I've been thinking it through, and I can't think of how it could be exploited (except for a modified URL being sent to users that prepopulate with a different user's username, but even still, I can't see how that could be exploited further).

Improve this question
3
  • 2
    What happens if a malicious user sends a link with a payload similar to "><script>mineCryptoCoins()</script> to a third party? Do you correctly escape the input? If so, not a problem, else you could end up with a reflected XSS issue (although probably only in old browsers)
    – Matthew
    Jan 4, 2018 at 10:19
  • 1
    The usual way to handle this is to take the username that was POSTed and just stick it in the value="" attribute of the input, I would be very surprised if ASP.NET didn't have a way to do this. I'm not too familiar with ASP.NET, but this may still be relevant, otherwise I'm sure more info could be found by searching.
    – AndrolGenhald
    Jan 4, 2018 at 15:03
  • security issue? no. privacy issue? yes, if not using https. but, why not just use localStorage?
    – dandavis
    Jan 4, 2018 at 19:12

1 Answer 1

Reset to default
2

The only security issue I can see with this is that you will have your usernames appear in all sorts of logs and in your users browser history. For most applications, that wouldn't really be a problem though.

Also, you might want to opt out from sending referer headers from the login page. Otherwise, if you link to external sites you could leak usernames to them. As a user, I do not want site A to know who I am on site B.

As Mathew points out, all the usual consideration when handling untrusted data applies - so you need to think about XSS etc.

(If this is a good way to do it with ASP.NET is a separate issue that I don't know the answer to.)

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .