CODEWITHSUNDEEP
phpsecurityhttppostserver
Melvin Langvik
Melvin Langvik

Reputation: 71

POST PHP Security, how to prevent

On my current website i use Jquery and POST requests between different PHP files to get and update information. Currently om not using either SSL or home grown encryption to hide the plain-text in the headers, that will come later.

I'm wondering how to prevent client side POST modification besides sanitizing and validating the inputs before using them. Some of the information passed between the PHP documents are hard to predict, therefore hard to validate.

Got any tricks up your sleeves? I was thinking i could use session stored data in PHP to validate that it was the actual server that sent the request. But i guess that session data can be "tapped" in many ways?

Upvotes: 0

Views: 287

Answers (2)

Neil McGuigan
Neil McGuigan

Reputation: 48287

Choose one:

  1. You can store data in session between requests (more server memory)

  2. You can sign the data sent to the client using an HMAC (more server cpu), then check it on the next request on the server

There's no excuse not to use HTTPS these days. 3 free vendors now.

Upvotes: 2

Scott
Scott

Reputation: 12396

Two important things about HTTP - It is, by nature, stateless, therefore every request is independent of any previous requests and secondly and more importantly - it is based on trust. Once data hits the server (specifically the php script), it is impossible to know where that request originated and if the data can be trusted. This means the only way to ensure data is clean and secure is if it is sanitized and validated.

Because of the inherent trust with HTTP, any client can forge a request with malicious intent. There are ways to make this harder, and depending on what you are trying to protect you can spend more time and resources to do so. These steps are different depending on what you are trying to accomplish. Are you trying to stop a malicious user from stealing others users information? Are you trying to stop them from accessing data on your server that they should not (sql injection, directory traversal)? Are you trying to prevent the user from impersonating another user (session hijacking)? Are you trying to prevent the user from injecting malicious javascript (xss)? Depending on your goal and your risk, you would invest time and energy to try and prevent one or all of these things.

Lastly, HTTPS only mitigates a man in the middle attack (maybe session hijacking) and not any of the above mentioned scenarios, so you still need to clean and scrub all data that your php receives.

Upvotes: 1

Related Questions