Re: put in safety my Rest Web Services

[Pete Helgren <pete@xxxxxxxxxx>]

Henrik,

This is where I plan to go and don't know if this is what the OP was 
concerned about.  What I don't want to have happen is that the 
http://serverip/getinfo.pgm?userid=aaaaa&password=bbbbb&account=123456 
is changed to 
http://serverip/getinfo.pgm?userid=aaaaa&password=bbbbb&account=654321 
and they are given account access to that account.  Yeah, I could check 
to make sure that the account is valid for that user, plus a few other 
steps, but hashing and salting are a bit more straightforward and 
require fewer steps (IMHO)...

Pete Helgren
www.petesworkshop.com
GIAC Secure Software Programmer-Java

On 8/18/2015 1:29 PM, Henrik Rützou wrote:
> Richard
>
> if you control both the client and the server it is quite simple.
>
> Lets say you have a URL like
>
>
> http://  serverip/getinfo.pgm?userid=aaaaa&password=bbbbb&account=123456
>
>
> you change the url to
>
>
> http://  serverip/getinfo.pgm?userid=aaaaa&hash=
> 4625fd63b0e96fc0d656ae7381605e48d4a0f63a319fc743adf22688613883c7&account=123456
>
> Everybody can do a HASH - but the HASH is 'salted'
>
> The user id aaaaa has a 'salt'-value only the client and the server knows
> so the input
> to the HASH algoritm is
>
> aaaaa123456salt
>
> There is no way you can break this security other than 'trail and error'
> since you cant
> deciber HASH values and the 'salt' is only known by the client and the
> server.