CODEWITHSUNDEEP
javascriptphppostencryptionform-submit
Jeremy
Jeremy

Reputation: 2546

Securely submit form using JavaScript / PHP

Before asking the question, I admit that this method is uberly discouraged and not secure. I am aware that to achieve this is through SSL.

However, I am developing an HTML5 apps (and it seems that implementing the SSL approach would take a lot of time) and I would like to know the best way to POST a form content.

i.e I have the following form

<form id="someform" name="someform" method="POST" action="some/server/url">

The way this form is submitted (currently) is using ajax $("#someform).serialize() and so on..

Using this implementation I am facing with (at least) these 2 immediate problems:

  1. User could use tools (i.e TamperData | a firefox addons) to modify the posted content (Interception-and-modify).
  2. User could forge the data by sending 'fake'submission (Forging)

I am wondering if there is somehow I could at least (obfuscate the POST-ed) value.

I came across with this great http://www.jcryption.org/ tools, but not sure how should I implement it to workaround the problem I am facing.

ps: again I am aware that relying on client-side script is way less secure compared with handling all execution from within the server-side.

framework + language I am using is: CodeIgniter + PHP + JavaScript (jquery)

1st Amendment:

I am sure there is at least a work around using this theory

First, I am not too worried about the confidentiality part of my data, that is the POST-ed value will not give any valuable information even if someone else knows what it is.

What concerns me though is the integrity and the authenticity of the POST-ed value. This is simply means that no one else should tamper the information once its being transmitted (once the submit button is clicked), nor anyone could forge or create a fake value (spoofing the server).

This theory leads to digital signature, where (again in theory) I should somehow sign the POST-ed value using server PUB-key, then hash the POST-ed value using the server PUB-key and finally send both the original POST-ed value along with the hashed value.

Prior sending the POST-ed value, the client MUST request for the server PUB-key, so the client can hash the POST-ed value. The server could probably store the PUB-key information along with SESSION information.

Then the server will have to (again) hash (this time with the server PRI-key) the original POST-ed value (sent by client) and compare the two hashed value. If those value is the same, it simply means it is authentic.

Now the part which I am yet to understand is the HOW.....

is there any tools/frameworks/plugins/tutorial/example on how to do this? since it would be too much for me (not to mention the limited amount of time I have) for developing the whole Public-Key-Infrastructure from scratch

Upvotes: 0

Views: 533

Answers (2)

jyoti
jyoti

Reputation: 350

User

Spoofed Form Submissions

You will get full info here

Upvotes: -1

Your Common Sense
Your Common Sense

Reputation: 157989

Take one step further and realize that a user can encrypt faked data as well.
And SSL won't help against such a tampering.

That's a web-development axiom: everything can be faked on the client side. Period.

So, instead of encrypting anything, just verify your input on the server side, like every other site does.

Use sessions to store the data that a user should have no access to.

Upvotes: 3

Related Questions