Re: put in safety my Rest Web Services

Henrik,

This is where I plan to go and don't know if this is what the OP was concerned about. What I don't want to have happen is that the http://serverip/getinfo.pgm?userid=aaaaa&password=bbbbb&account=123456 is changed to http://serverip/getinfo.pgm?userid=aaaaa&password=bbbbb&account=654321 and they are given account access to that account. Yeah, I could check to make sure that the account is valid for that user, plus a few other steps, but hashing and salting are a bit more straightforward and require fewer steps (IMHO)...

Pete Helgren
www.petesworkshop.com
GIAC Secure Software Programmer-Java

On 8/18/2015 1:29 PM, Henrik Rützou wrote:

Richard

if you control both the client and the server it is quite simple.

Lets say you have a URL like


http:// serverip/getinfo.pgm?userid=aaaaa&password=bbbbb&account=123456


you change the url to


http:// serverip/getinfo.pgm?userid=aaaaa&hash=
4625fd63b0e96fc0d656ae7381605e48d4a0f63a319fc743adf22688613883c7&account=123456

Everybody can do a HASH - but the HASH is 'salted'

The user id aaaaa has a 'salt'-value only the client and the server knows
so the input
to the HASH algoritm is

aaaaa123456salt

There is no way you can break this security other than 'trail and error'
since you cant
deciber HASH values and the 'salt' is only known by the client and the
server.