RE: CGI Fact Finding Mission (Need Input) -- MIDRANGE-L

I was wondering about the implications of "defensive" programming, to
(primarily) prevent web hacking and proof the application if the user does
not have JavaScript / cookies enabled.

To secure an application, I'd like to present as little information (in
links) as possible. For instance:
<a
href="myhost/mycgi?name=loyd&client=client&session=aaabbbccc&action=browse">
Browse items</a>
could be hacked. I like to use:
<a href="myhost/mycgi?session=aaabbbccc&option=1">Browse items</a>
I use option 1 and session aaabbbccc to perform a database lookup, and get
the values for name and client.

Notice I'm not talking about object authority, but using the values as
passed by the user. This is also different from hashing/encrypting
information or using SSL for session encryption.

The point I'm making is, what happens when I disable javascript? If the
application uses ONLY javascript to validate data, there's huge problems, I
think.

I'm actively searching for information on defensive programming in regard to
web-based applications. There's a little information in the book _Hacking
Exposed: Network Security Secrets and Solutions_ by Stuart McClure, Joel
Scambray, and George Kurtz.
Any ideas?
Loyd
-----Original Message-----
> From: Stone, Brad V (TC OASIS) [SMTP:bvstone@taylorcorp.com]
> Sent: Wednesday, 17 November, 1999 2:43 PM
> To:   'MIDRANGE-L@midrange.com'
> Subject:      RE: CGI Fact Finding Mission (Need Input)
> 
> Whew! Lots of questions... I'll give em a shot below...
> 
> > 
> >     Can Java help me? We are an RPG shop and I don't want 
> > to be the only
> > one who knows Java. If I use Java do I have to purchase 
> > something and where
> > do I get started? Can Pearl help me?
> 
> If you're an RPG shop, don't take on a new project to learn Java, IMHO.
> Javascript, though, you should learn and can learn on the way.  Learn Java
> on your spare time (what's that?) and then later you may be able to
> incorporate it.  I prefer not to try and learn something on mission
> critical
> projects.  Perl, you won't need that if you're using RPG for CGI.
> 
> JavaScript is not Java.. that confuses people.  I could tell you
> stories...heheh..
> 
> > 
> >     I also had trouble with numeric fields in the data base 
> > and matching
> > up the form field. Is there a way to ensure numeric input in 
> > a form field? 
> 
> You should verify the data in a form field that should be numeric with
> Javascript.  There are a ton of JS routines out there that will do this
> easily.  You will also want to look into a JS routine that strips trailing
> blanks when doing low-level field verification with JS.  (Yes, JS plays a
> very important role in a good internet app).
> 
> 
> HTH!
> 
> Bradley V. Stone
> BVS/Tools
> http://www.bvstools.com
> 
+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---