Skip to main content

Insecure authentication method - Basic

Need​

Secure authentication method

Context​

  • Usage of Java 8 for developing applications with enhanced features and performance improvements
  • Usage of javax.servlet-api for building Java web applications with servlets
  • Usage of java-base64 for encoding and decoding data in Java

Description​

Non compliant code​

import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;

public class BasicAuthServlet extends HttpServlet {
    protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        String authHeader = request.getHeader("Authorization");
        if (authHeader != null) {
            // Authorization: Basic base64credentials
            String credentials = new String(Base64.getDecoder().decode(authHeader.substring(6)), StandardCharsets.UTF_8);
            // credentials = username:password
            final String[] values = credentials.split(":", 2);
        }
    }
}

The above Java servlet represents a server-side component that uses Basic authentication over an insecure channel, which is a common vulnerability in web applications.

In this code, the doGet method retrieves the "Authorization" header from the incoming HTTP request. If this header is not null, it proceeds to decode the Base64 encoded credentials (username and password) that follow the "Basic" authentication scheme keyword.

The problem with this code is that it doesn't implement any form of secure communication, such as HTTPS. Therefore, the credentials which are sent from the client-side to the server-side are vulnerable to Man-in-the-Middle (MitM) attacks, where an attacker could potentially intercept the request and gain unauthorized access to sensitive information.

Furthermore, the Basic authentication scheme itself is not secure because it simply encodes the username and password with Base64, which is a form of encoding, not encryption. This means that anyone who intercepts the HTTP request could easily decode the Base64 string and retrieve the original credentials.

In summary, this code is vulnerable due to the use of Basic authentication over an insecure channel and the lack of secure communication protocol like HTTPS.

Steps​

  • Use a secure channel for communication, such as HTTPS, to protect the authentication process.
  • Implement a stronger authentication method, such as token-based authentication or OAuth, instead of Basic authentication.
  • Avoid storing passwords in plain text. Use secure password hashing algorithms, such as bcrypt, to store and verify passwords.
  • Implement proper session management to prevent session hijacking and ensure the security of authenticated sessions.
  • Implement rate limiting and account lockout mechanisms to protect against brute-force attacks.
  • Regularly update and patch the server and its dependencies to address any security vulnerabilities.
  • Perform security testing and code reviews to identify and fix any other potential security vulnerabilities.

Compliant code​

import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;

public class SecureAuthServlet extends HttpServlet {
    private BCryptPasswordEncoder passwordEncoder = new BCryptPasswordEncoder();

    protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        String authHeader = request.getHeader("Authorization");
        if (authHeader != null) {
            // Authorization: Bearer token
            String token = authHeader.substring(7);
            // Verify the token
            // If the token is valid, retrieve the user details and process the request
            // If the token is invalid, return an HTTP 401 Unauthorized response
        }
    }

    private boolean isPasswordValid(String rawPassword, String encodedPassword) {
        return passwordEncoder.matches(rawPassword, encodedPassword);
    }
}

The updated code uses a secure authentication method instead of Basic authentication. It expects an Authorization header with a Bearer token, which is a more secure method of authentication. The token is extracted from the Authorization header and then verified. If the token is valid, the server processes the request. If the token is invalid, the server returns an HTTP 401 Unauthorized response.

The code also includes a method to verify passwords using the BCrypt password hashing algorithm. This method takes a raw password and an encoded password as input, and returns true if the raw password matches the encoded password, and false otherwise. This method is used to verify the user's password during the login process.

This code should be used over a secure channel, such as HTTPS, to protect the authentication process. It should also be combined with proper session management, rate limiting, account lockout mechanisms, regular updates and patches, and security testing and code reviews to ensure the security of the server.

References​

Last updated on