1

I've come upon what I would call some "nasty" javascript coding (I come from a KnockoutJS / Angular / Web API 'world') in which WCF services are exposed to javascript by production URL's, i.e. "productionserver.com.WCFService.WCFfunction(parameter, parameter)"

Here's an actual piece of code (with some changes, of course)

 www.blah.com.blahService.DoesEmailExist(mail, function (response) {
//blah code
}

And, here's the invoked WCF function:

public bool DoesEmailExist(string email)
        {
            try
            {
                if (!string.IsNullOrEmpty(BusinessObjectWrapperToCreateQuery,"SELECT Id FROM TheTableToQuery WHERE Email =  :Email ", email)))
                {
                    // user exists
                    return true;
                }
            }
            catch (Exception Ex)
            {
                LogSomeStuff(Ex);
                return false;
            }

            return false;
        }

There's nothing checking the user's session or the validity of the request, i.e. 'are you who you say you are' ?

I've started integrating with a third party, BrainTree (quite legit, in terms of security actually), to capture bank account info / address/ date of birth.

One purposed solution was to put this over SSL, but I'm not sure that's totally correct.

The solution I have in my mind is:
- Put the page on SSL
- Generate a nonce each time a user loads the page to collect data comprised of hashed values such as: username, current binary time stamp, IP, etc, and a salt.
- Each request requires the generated nonce, and only if the recreated hash on the server's part equals the one sent by the client do I consider the request valid.
- Ditch WCF for Web APi over SSL and POST request by the body

This could work, however, I'm not a fan of unsecured endpoints exposed through javascript.

I'm hesitant to say that this site in its current configuration will ever be secure, but I will not be storing any of this info locally, and will defer this off to Braintree.

Edit

What I'm looking for is a more educated opinion on:
- Is my purposed solution solid?
- Are my concerns with the current JS/ WCF not over SSL a concern?
- Is it worth my time to make one section of a site incredibly secure with many other security issues elsewhere?

  • So, what do you really want us to help you with? – DarkLighting Apr 17 '15 at 21:42
  • @DarkLighting Updated the question! – Nick Olinger Apr 17 '15 at 21:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.