1

Imagine that there is server required authentication for getting an access to some endpoint.

And developer added some logic to bypass the authentication: if server recieve HTTP header give_me_access=true, then server answers without requiring authenticaton.

Is there way for an attacker to know that the server accept this header?

1
  • 1
    You know because it works? Or are you asking if it is possible to know what the server-side logic is configured to accept? If the latter, then, no.
    – schroeder
    Jul 23 at 18:25
0

No, not really. There is no part of the HTTP protocol where the server is expected to list headers it is interested in. It's not common practice for servers to do either - I have never seen anything like that anywhere.

You could guess the name or try to brute force it. But unless the name is obvious, you are very unlikely to succeed since the brute force has to be done online, one HTTP request per guess.

If you have access to the source code (or even the binaries) that the server is running, you could find the answer there. Or perhaps some leaked documentation or social engineering could provide you with this information.

So if there is no obvious way to exploit this, does it mean that a bypass like that is a secure thing? Absolutely not. Expect your source code to be leaked. Secrets should be separate from source code, and easily replaced. A hardcoded backdoor like that is the opposite.

I don't know if you were considering making one. But please don't.

1

In my opinions, this is actually an XY problem.

Based on header name give_me_access I would suppose, that the real question the author wanted to ask is following:

What are the risks if the security is based on the secrecy of the name of the custom HTTP header?

The formal answer to the OP is: No, there is no way to know if the server reacts in particular way on some HTTP headers.

But if the question is, how safe is to rely on the secrecy of the header name, then the answer is following. According to Kerckhoffs's principle you should assume an attacker knows the source code of your application and the logic it implements. Means, you should expect that the attacker knows all customer header names you use and knows the meaning of any fixed special values of these headers. That's why using secrecy of header names makes your application more obscure, but not more secure.

1
  • I would describe this as the application having an additional hardcoded password of "give_me_access".
    – Ángel
    Jul 25 at 0:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.