Skip to main content

Sensitive information sent via URL parameters

Need​

Protection of sensitive information during transmission

Context​

  • Usage of C# for developing robust and efficient software applications
  • Usage of _context for managing state and data in a specific context
  • Usage of IActionResult for handling and returning HTTP responses in a structured manner
  • Usage of _context.Users for accessing user data within the context
  • Usage of FirstOrDefault for retrieving the first element from a collection or a default value

Description​

Non compliant code​

[HttpGet]
public IActionResult GetUserDetails(string username, string password)
{
    // Code to retrieve user details
    // This is a simple example and does not represent a secure way to authenticate users
    var user = _context.Users.FirstOrDefault(u => u.Username == username && u.Password == password);
    
    if (user != null)
    {
        return Ok(user);
    }
    else
    {
        return NotFound();
    }
}

This C# code snippet is a GET method in an ASP.NET Core application that retrieves user details based on the username and password provided. The method receives the username and password as URL parameters.

The vulnerability in this code is that it sends sensitive information (username and password) via URL parameters. These parameters are:

  • Stored in clear text in the browser history.
  • Sent to external sites via the referrer HTTP header.
  • Sent to external sites via the search bar if the browser interprets the URL as a query.
  • Visible to scripts running on the browser that may belong to third parties.

In addition, this code does not perform any form of encryption or hashing on the password, which means that it is stored and transmitted in clear text, increasing the risk of it being intercepted and exploited.

This method of sending sensitive information is insecure and should be avoided. Instead, sensitive information should be sent using POST requests and over a secure HTTPS connection.

Steps​

  • Avoid sending sensitive information via URL parameters.
  • Use the POST method instead of the GET method to send sensitive information.
  • Encrypt sensitive information before sending it over the network.
  • Store sensitive information securely on the server-side.
  • Implement proper authentication and authorization mechanisms to protect sensitive information.
  • Use secure protocols (e.g., HTTPS) to ensure the confidentiality of sensitive information during transmission.
  • Implement input validation and sanitization to prevent malicious input from being processed.
  • Avoid logging sensitive information in plain text or insecure locations.
  • Educate users about the risks of sharing sensitive information via URLs and encourage them to use secure methods of communication.

Compliant code​

[HttpPost]
public IActionResult GetUserDetails([FromBody] UserCredentials userCredentials)
{
    // Code to retrieve user details
    // This is a simple example and does not represent a secure way to authenticate users
    var user = _context.Users.FirstOrDefault(u => u.Username == userCredentials.Username && u.Password == userCredentials.Password);
    
    if (user != null)
    {
        return Ok(user);
    }
    else
    {
        return NotFound();
    }
}

public class UserCredentials
{
    public string Username { get; set; }
    public string Password { get; set; }
}

The previous code was vulnerable because it was sending sensitive information (username and password) via URL parameters using the GET method. This is a security risk because these parameters are stored in clear text in the browser history, sent to external sites via the referrer HTTP header, visible to scripts running on the browser that may belong to third-parties, and sent to external sites via the search bar if the browser interprets the URL as a query.

The updated code now uses the POST method instead of the GET method to send sensitive information. This is more secure because the data is sent in the body of the HTTP request, not in the URL. This means the data is not stored in the browser history or sent to external sites via the referrer HTTP header.

The sensitive data is now encapsulated in a UserCredentials object, which is passed in the body of the POST request. This object is decorated with the [FromBody] attribute, which tells ASP.NET Core to bind the object from the body of the HTTP request.

This is a simple example and does not represent a secure way to authenticate users. In a real-world application, you should never store passwords in plain text, and you should implement proper authentication and authorization mechanisms to protect sensitive information. You should also use secure protocols (e.g., HTTPS) to ensure the confidentiality of sensitive information during transmission, and implement input validation and sanitization to prevent malicious input from being processed.

References​

Last updated on