1

When sending a request (POST, PUT, etc). I have a security requirement to ensure that the data in the payload has not been tampered with.

In other words I need to know with certainty that the data entered was entered by the user and has not been intercepted in flight with additional or altered data.

What are strategies and tactics to accomplish this?

I thought of using a key from a previous GET request followed by hashing the whole payload along with a timestamp. However I don’t see this as a solution since if there were a reverse proxy or key logger listening to an end-user's requests, then that keylogger and reverse proxy would just as soon know what the key used to hash was and could just overwrite the payload with the key and hash anyway - using the servers expected key and looking like a legitimate hash of the payload. Any ideas?

Improve this question
2
  • "... the payload has not been tampered with ..." - tampered by what? Everything between client and server can be secured with TLS. Everything at the server or at the client (i.e. compromised, malicious extension, broken server code) is out of control of TLS and need to be addressed differently. There is no way to be sure what the user entered without actually watching the user.
    – Steffen Ullrich
    Commented Jun 7, 2021 at 14:25
  • 2
    If the endpoint is compromised, (as with a keylogger) then your responsibility ends as a service provider. Any tactic you use can be defeated on the endpoint.
    – schroeder ♦
    Commented Jun 7, 2021 at 14:37

2 Answers 2

Reset to default
1

If the end-user’s system is compromised there nothing you can do to detect that data is coming from a legitimate user. However, you can use following measures to ensure some level integrity:

  1. mTLS: Mutual Authentication for web request.

  2. Issue a certificate for end users and store the keys into some hardware-based security modules e.g., smart card, TPM or HSM etc.

    • You need to ensure that issuing certificate authority is good enough to be trusted.
    • Windows key store or Keyring in Linux will also work but they do not provide high level security comparatively.

  3. Use certificate parameters for authentication such as serial number or thumbprint to ensure the certificate belong to issuing person.

  4. If you go with smart card, you can set PIN on smart cards to ensure extra security.

For all the above steps if you are using popular web server like Apache or nginx they provide the functionality to setup mTLS with configuration parameters mentioned above.

Improve this answer
1
  • thanks, I am not using NGINX because it is not FIPS compliant without enterprise license
    – user1709076
    Commented Jun 22, 2021 at 13:50
0

The term for what you are referring to is integrity. One of the goals of any secure protocol (including TLS, which is used on the web with https protocol) is to ensure integrity, which is another way of saying that the protocol ensures that the data has not been tampered with or modified by an attacker while being transported via the protocol. So, in a web application, you can simply rely on TLS to ensure integrity of the data in transit between the client and the server.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .