1

I am using a third party website in which I observe the following behavior for Change Password.

  1. The system has userA with mobileNumberA and userB with mobileNumberB
  2. User B wants to change password. System shows mobileNumberB (non editable field) and asks to confirm so that change password link can be sent
  3. User B changes the value in mobile field to mobileNumberA using developer tools and clicks ok
  4. System sends change password corresponding to user A's account to mobileNumberA.

User A can ignore the SMS as he didn't request to change passwords. Tthe change password link is created using both user and mobile number, and in this case only user A can change his password. User B cannot change user A's password. All these are fine. But I would expect that server should ignore if any changes are sent for non editable fields. Can I raise this as security concern?

1

But I would expect that server should ignore if any changes are sent for non editable fields

In no way should the server-side blindly trust that the client input. This includes not trusting that the client will not modify read-only fields.

Instead data which should not be modified by the user might simply not be included at all when sending the form, i.e. the server can read the users phone number from database. Alternatively read-only data could be protected so that modification by the client will be detected. This can be done for example with a signature or HMAC over all read-only fields which is generated by the server and can be verified by the server.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.