Solved

How can I protect my website from javascript injections or cookie edits?

Posted on 2009-04-14
4
527 Views
Last Modified: 2013-11-25
I was browsing the web for possible security issues with my website, and I was shocked at what I found.  I was able to login to administrator accounts without knowing username and login information, and do anything I wanted within my site.

I typed the following into the URL:
javascript:alert(document.cookie);

I store user login information in the cookie by using login=USER_ID

I then typed in:
javascript:void(document.cookie="login = 1");

This gave me access to my entire site!

So my question is....how do I prevent this?  I'm assuming I'll have to recode how my site determines when a user is logged in.
0
Comment
Question by:stackshady
  • 2
  • 2
4 Comments
 
LVL 16

Expert Comment

by:Blaz
ID: 24136630
Use session for "login" variable instead of a cookie. The user does not have access to session variables.
0
 

Author Comment

by:stackshady
ID: 24136815
Thanks Blaz, but I need the users to stay logged in for up to 2 weeks at a time.  I thought sessions were only temporary and go away after the user closes the browser, thus having to login every time.  Is there a way to make them last longer or do I need to store a cookie that will create a new session somehow?  Thanks for the help.  (I'm coding in PHP by the way)
0
 
LVL 16

Accepted Solution

by:
Blaz earned 125 total points
ID: 24136913
You could code something similar to sessions yourself.

Every time the user logs in create a unique ID (long) 6666666-7777777-888888888-99999999-11111111-QWRGRRDSAG. Save this ID to your database together with information about this "session" - login ID, username, login time, last access time... Save this ID also to client cookie. Always match the ID from the cookie with your database. You could also match username in cookie and the database etc.

If you find a match you get the user ID from the database.

Update access time everytime you check the login ID (probably on every page)

Delete records where last access time > 2 weeks.
0
 

Author Closing Comment

by:stackshady
ID: 31569831
This makes sense, thank you!
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

Phishing is at the top of most security top 10 efforts you should be pursuing in 2016 and beyond. If you don't have phishing incorporated into your Security Awareness Program yet, now is the time. Phishers, and the scams they use, are only going to …
Nothing in an HTTP request can be trusted, including HTTP headers and form data.  A form token is a tool that can be used to guard against request forgeries (CSRF).  This article shows an improved approach to form tokens, making it more difficult to…
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, Just open a new email message.  In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
You have products, that come in variants and want to set different prices for them? Watch this micro tutorial that describes how to configure prices for Magento super attributes. Assigning simple products to configurable: We assigned simple products…

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

20 Experts available now in Live!

Get 1:1 Help Now