I have several web based applications that will redirect unauthenticated users to an ADFS sign-in page. ADFS will subsequently redirect users back to a web application once authenticated with a token.

Since the web application issues a browser redirect - someone who hacks the web application could update the sign-in page URL with a fake sign-in page URL and capture a user's credentials.

What steps could I take to secure the URL?


It sounds like you are worried that your users enter their credentials on another page than your real login page. In your case this is because the web application is hacked, but this is more commonly achieved by phishing attacks, so you may want to look into solutions against phishing.

There are a couple of ways to ensure users only authenticate on the correct domain:

  • U2F hardware tokens. This is a USB dongle with a cryptographic key on it.
  • Using a password manager that only autofills credentials when on the correct domain.
  • Training users to recognize phishing pages, such as checking the URL.

Edit: Using two-factor authentication such as TOTP or SMS tokens don't prevent phishing, since the phishing page can also ask for these. It makes it a little bit harder since the attacker can only log in once with the captured credentials.

U2F is different in this respect, because of crypto. The token creates a signature of the domain name. The captured credentials only work on the phishing page and not on the real login page, so the attacker can't log in.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.