0

I want to know what is the best approach for preventing URL Jumping / URL Tampering Attacks

Example

updateprofile.php?uid=1 

I can change to

updateprofile.php?uid=2

I can update the second user's profile without logging in into his or her account.

So how I can prevent this type of attacks? By using Session variables? Encrypting the data through the URL?

I am sure sessions are vulnerable to XSS or Session Hijacking Attacks.

So what is the best approach for this? Coding approach etc.

2

updateprofile.php?uid=1 I can change to

updateprofile.php?uid=2

If you can change the uid parameter and then tweak other persons profile that would mean the backend application has no checks as to determine if a user is eligible to perform an action.

This attack can be a combination or any of the following including (bad session management,url tampering,indirect object reference,parameter tampering)

So how I can prevent this type of attacks? By using Session variables? Encrypting the data through the URL?

Yes,SESSIONS combined with logical checks are the way to solve such attacks.

I am sure sessions are vulnerable to XSS or Session Hijacking Attacks.

SESSIONS have nothing to do with XSS.

So what is the best approach for this? Coding approach etc.

The coding approach is to use SESSION Token to uniquely identify a user.Then perform server side checks to determine if a user is authorised to perform an action such as editing a profile.If he isn't simply don't allow him.

  • Thank you for responding , is it possible you give some brief code examples that I can have a bigger picture about it? – Cash- Jun 1 at 18:26
  • 3
    There is no bigger picture here.Download any book on web development and go through the chapter on session management.I am sure you will understand it. – Vipul Nair Jun 1 at 19:17
  • I do not know the correct approach but before I knew about session management. I always store the username into SESSION["Username"], that's how I authorized users before visiting a page or performing actions. I do not use any token IDs or persistent cookies. So, Is this also considered a way to do it? – Cash- Jun 2 at 2:07
  • @Cash- yes its the same logic but two people can have the same username so instead you use a unique token.If you read the chapter on session management you would understand it, – Vipul Nair Jun 2 at 5:47
  • Thank you but I used my username is a primary key instead and have client-side validation for the same username so I assume the logic here is fine? – Cash- Jun 2 at 5:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.