Interesting... What about using a subdomain and having authentication cookies tied to *.domain.com with the HTTPOnly flag set? It does sound risky but I can't think of any attack.
It not only sounds risky, hosting user content on sub domains is risky. I've seen several times that this has opened the way to exploitation of session fixation issues. There are further attack vectors as cross domain policies, CORS or document.domain for such setups.
So putting user provided content in a separate domain is an very good idea.
oam: it's an improvement, but there are at least two problems with just using something like http[s]://userfiles.example.com/predictable_URL.pdf:
1) If the attacker knows the URL of any interesting private document within userfiles.example.com, and can host his own malicious file in the same origin, it is fairly easy to steal sensitive data.
2) Although httponly cookies can't be read back by scripts (spare for semi-frequent plugin bugs), they can be typically overwritten with some minimal effort - which will often have very serious consequences, especially for complex web apps.
Probably not in English :-) But the basic idea is that Internet Explorer would give precedence to BOM indicators in the file over charset= value present in Content-Type or META, allowing many documents to suddenly become UTF-7 or so.
I believe that Microsoft folks changed this behavior earlier this year.
To oam's question about subdomains, I believe that if you allow this and you have loose cookie rules, you are vulnerable to cookie tossing, aka "Same Origin Policy Abuse Techniques".
The internet takes the path of Linux/Unix. All the design flaws will be changed in time. Changing the entire internet protocol suite is option 2. Think about writing a replacement for TCP/IP, it's a funny one.
Security is one of the major issue with my website, I had my website with only HTML and was not using any dynamic feature expect some little things. After a good start I start to get success online and decide to go with a wordpress website, but within a few week after my new website launch, I felt real setback because my website was showing error and showing some hack message. Don't know enough about these, my developer fail to handle the situation so I got the website restored by my web host, but I am still worried if it will became much worse then ?
Hey! This post couldn’t be written any better! Reading through this post reminds me of my good old room mate! He always kept talking about this. I will forward this article to him. Pretty sure he will have a good read. Many thanks for sharing!
I think the web takes the way of Linux/Unix. All the outline defects will be changed in time. Changing the whole web convention suite is alternative 2. Ponder composing a swap for TCP/IP, its an amusing one. for more detail Click Here
At first glance cheap web hosting may seem unenchanting, however its study is a necessity for any one wishing to intellectually advance beyond their childhood. Though cheap web hosting is a favourite topic of discussion amongst monarchs, presidents and dictators, cheap web hosting is not given the credit if deserves for inspiring many of the worlds famous painters. The juxtapositioning of cheap web hosting with fundamental economic, social and political strategic conflict draws criticism from the easily lead, many of whom blame the influence of television.
Follow
18 件のコメント :
Interesting...
What about using a subdomain and having authentication cookies tied to *.domain.com with the HTTPOnly flag set? It does sound risky but I can't think of any attack.
It not only sounds risky, hosting user content on sub domains is risky. I've seen several times that this has opened the way to exploitation of session fixation issues. There are further attack vectors as cross domain policies, CORS or document.domain for such setups.
So putting user provided content in a separate domain is an very good idea.
oam: it's an improvement, but there are at least two problems with just using something like http[s]://userfiles.example.com/predictable_URL.pdf:
1) If the attacker knows the URL of any interesting private document within userfiles.example.com, and can host his own malicious file in the same origin, it is fairly easy to steal sensitive data.
2) Although httponly cookies can't be read back by scripts (spare for semi-frequent plugin bugs), they can be typically overwritten with some minimal effort - which will often have very serious consequences, especially for complex web apps.
Yeah it makes sense. Thanks !
Was the "Byte Order Mark (BOM) vulnerability reported to us by Masato Kinugawa" described anywhere in more detail?
Probably not in English :-) But the basic idea is that Internet Explorer would give precedence to BOM indicators in the file over charset= value present in Content-Type or META, allowing many documents to suddenly become UTF-7 or so.
I believe that Microsoft folks changed this behavior earlier this year.
To oam's question about subdomains, I believe that if you allow this and you have loose cookie rules, you are vulnerable to cookie tossing, aka "Same Origin Policy Abuse Techniques".
http://webapp-hardening.heroku.com/cookietossing
The internet takes the path of Linux/Unix. All the design flaws will be changed in time. Changing the entire internet protocol suite is option 2. Think about writing a replacement for TCP/IP, it's a funny one.
Very informative post! Thanks a lot!
very informative point here.
Security is one of the major issue with my website, I had my website with only HTML and was not using any dynamic feature expect some little things. After a good start I start to get success online and decide to go with a wordpress website, but within a few week after my new website launch, I felt real setback because my website was showing error and showing some hack message. Don't know enough about these, my developer fail to handle the situation so I got the website restored by my web host, but I am still worried if it will became much worse then ?
It’s great to see good information being shared and also to see fresh, creative ideas that have never been done before.
Hosting Services Karachi
I would like to say this is an excellent site that I have ever come across. Very informative. Please write more so that we can get more details.
Web Hosting
Hey! This post couldn’t be written any better! Reading through this post reminds me of my good old room mate! He always kept talking about this. I will forward this article to him. Pretty sure he will have a good read. Many thanks for sharing!
Check also domeinnaam check Thanks!
Thank you buddy for sharing this stuff..
Linux Reseller
Ideally i think companies begin up with shared hosting services and move up to VPS /dedicated hosting. A nice brief on all types of hosting!
I think the web takes the way of Linux/Unix. All the outline defects will be changed in time. Changing the whole web convention suite is alternative 2. Ponder composing a swap for TCP/IP, its an amusing one. for more detail Click Here
At first glance cheap web hosting may seem unenchanting, however its study is a necessity for any one wishing to intellectually advance beyond their childhood. Though cheap web hosting is a favourite topic of discussion amongst monarchs, presidents and dictators, cheap web hosting is not given the credit if deserves for inspiring many of the worlds famous painters. The juxtapositioning of cheap web hosting with fundamental economic, social and political strategic conflict draws criticism from the easily lead, many of whom blame the influence of television.
コメントを投稿