Skip to main content

Sensitive information sent via URL parameters

Need​

Protection of sensitive information during transmission

Context​

  • Usage of PHP 7.0 for server-side scripting and web development
  • Usage of Request for making HTTP requests
  • Usage of the App\User module for user-related functionality
  • Usage of a view library for rendering dynamic HTML templates

Description​

Non compliant code​

Route::get('/user', function (Request $request) {
    $user = App\\User::find($request->get('id'));
    return view('user.profile', ['user' => $user]);
});

In the above code snippet, we are using the Laravel framework to create a route that accepts a GET request to the '/user' URL. The user ID is passed as a parameter in the URL. This user ID is then used to find the corresponding user in the database and return a view of their profile.

This code is vulnerable because it sends sensitive information (the user ID) via URL parameters. This exposes the information to several risks:

  • The user ID is stored in clear text in the browser history. Anyone who has access to the browser history can see the user ID.
  • If the user clicks on a link to an external site from the profile page, the user ID may be sent to the external site via the referrer HTTP header.
  • If the browser interprets the URL as a query, the user ID may be sent to external sites via the search bar.
  • Scripts running on the browser that may belong to third parties can access the user ID from the URL.

This vulnerability can be exploited to gain unauthorized access to user profiles or perform actions on behalf of the user.

Steps​

  • Replace the GET method with the POST method to send sensitive data. This will prevent the data from being stored in the browser history or sent via the referrer HTTP header.
  • Encrypt sensitive data before sending it. This will prevent it from being readable if intercepted.
  • Use HTTPS instead of HTTP to ensure that the data is sent over a secure connection.
  • Implement access controls to ensure that only authorized users can access the sensitive data.
  • Use tokens or session management to track user authentication and prevent unauthorized access.

Compliant code​

Route::post('/user', function (Request $request) {
    $user = App\\User::find($request->input('id'));
    return view('user.profile', ['user' => $user]);
})->middleware('auth');

The above code has been modified to address the vulnerability of sending sensitive information via URL parameters.

  1. Method Change: The HTTP method has been changed from GET to POST. This is done by replacing Route::get with Route::post. This change ensures that the sensitive data (in this case, the user ID) is not appended to the URL, and thus, it is not stored in the browser history or sent via the referrer HTTP header.

  2. Data Retrieval: The Request::get method has been replaced with Request::input. This is because, in Laravel, the input method is used to retrieve input data from both GET and POST requests. This change is necessary because we have switched from a GET to a POST request.

  3. Middleware: The ->middleware('auth') has been added to the route. This middleware ensures that only authenticated users can access this route. This is an important security measure to prevent unauthorized access to sensitive data.

Please note that this code assumes that you have set up authentication in your Laravel application. If you haven't, you will need to do so for the auth middleware to work.

Also, remember to use HTTPS instead of HTTP to ensure that the data is sent over a secure connection. This is done at the server level and is not reflected in this code.

Finally, remember to encrypt sensitive data before sending it. This is also done at the server level and is not reflected in this code.

References​

Last updated on