We administer a Java web application from an external supplier where we have access to the source code.
The user is able to provide an external URL which is stored in a database and later on embedded in a website generated by the web application. Only stuff members can supply URLs. The URL is properly escaped and embedded into the web page as a call to a redirect servlet together with three parameters:
- external URL
- timestamp of the database entry
- hash code
The hash is calculated from the URL, the timestamp, and a server secret. The server secret is a GUID calculated at startup.
The redirect servlet recalculates the hash and throws an error if it doesn't match the embedded hash.
The disadvantage is that on each server restart the server secret changes and any hash will be invalid. The problem arises with search bots like Google or Yahoo which queues crawled URLs accross server restarts. Hence after restarting the server the error log is flooded with messages of invalid external URLs.
- Is this a common pattern in web applications?
- What are the security benefits of the hash?
- Is it "safe" to calculate the hash without the server secret?
- Are there any security patterns which provide the same security benefit but which are not susceptible against server restarts?