CODEWITHSUNDEEP
asp.netjavascriptsecurityjson
Compiler
Compiler

Reputation:

JSON Security

Do Pagemethods and Json have security risks?(I dont use cookies).Forexample i have a pagemethod and i am sending user id as a parameter but i dont want to show it to user.Can user get user id from pagemethod?

Upvotes: 1

Views: 842

Answers (6)

badunk
badunk

Reputation: 4350

if the userid is in a hidden form field, then it is completely exposed to anyone who views the source code in the browser. Not only can they see the userId, but they can see how you are sending it to the server.

In general, you never trust the client with sensitive data. Assume that they can always manipulate the response.

The way to securely pass messages is to give the user some session token in the form of a string. This session token should be generated with a fair amount of randomness and includes their username in the algorithm. Take a look at resources regarding md5 and salting. With this token that you give them, the assumption is now that they cannot reverse engineer the contents. Since they do not have the algorithm (it is sitting on the server side), then they cannot tamper with it. Your server will have to decrypt the session token to retrieve the userId of course.

This in itself does not mean your application is completely secure - it only fixes one of potentially many issues.

Upvotes: 0

Compiler
Compiler

Reputation:

I am hiding user id parameter in Hidden Field and just concerned that can it be changed while in that Process.Thanks all of your supports

Upvotes: 0

user53964
user53964

Reputation: 531

JSON can utilize FormsAuthentication security just like pages. What I usually do if I don't want the end-user to see an identifier, is to store that value (or something I can use to lookup that value) in User.Identity.Name.

The most complicated part of this approach is that the JSON may not return anything if you aren't authenticated. To work around this, I tend to include a non-authenticated page for getting JSON to tell you if the user is logged in or not.

Upvotes: 0

olle
olle

Reputation: 4595

yes they can (see the user id). Any communication between the server and client can be seen by the user. Take a look with fiddler or firebug to see what goes on. You can treat it the same as any regular get or post request.

I know of no reason why not to use it. Without knowing any of the background I can't give a definitive answer on whether I would choose it but in general there is no reason not to use it just apply the same security you would use for HTTP get and post requests like in regular form submissions.

Upvotes: 3

rodbv
rodbv

Reputation: 5264

It has the same security risks as a regulat GET and POST, it is just another format to send the data back and forth. If you were using a regular POST, anyone would be able to see the userid just the same.

So if you don't want to have people messing up with the userid you could add some sort of encrypted string dependent on the userid to go along with it, for validation, to name one of many possible solutions.

Upvotes: 1

Bob Fanger
Bob Fanger

Reputation: 29897

JSON has no security by itself, It's an unencrypted data-format.

Upvotes: 0

Related Questions