Difference between revisions of "How to protect sensitive data in URL's"

Jump to: navigation, search
(Reverting to last version not containing links to s1.shard.jp)
Line 1: Line 1:
[http://s1.shard.jp/losaul/lions-club-australia.html kite surfing victoria australia
] [http://s1.shard.jp/losaul/exchange-rate-australian.html australia national flag
] [http://s1.shard.jp/frhorton/78vbl98c2.html african american kids hair styles
] [http://s1.shard.jp/galeach/new134.html optic nerve aplasia
] [http://s1.shard.jp/bireba/nortons-antivirus.html manually remove symantec antivirus client
] [http://s1.shard.jp/olharder/3-auto-geneva.html ebay fake autograph
] [http://s1.shard.jp/olharder/stan-olsen-auto.html semi auto stretch wrapper
] [http://s1.shard.jp/olharder/kragen-auto.html auto bmw discount part
] [http://s1.shard.jp/frhorton/tyyykyebz.html child game from africa
] [http://s1.shard.jp/losaul/why-do-we-have.html australia dating online
] [http://s1.shard.jp/olharder/autopilot-off-clockwork.html grand theft auto sanandreas cheat pc
] [http://s1.shard.jp/olharder/autodesk-inventor.html autometrics.net
] [http://s1.shard.jp/frhorton/e38mrj5ac.html 2 4890508.stm africa go hi news.bbc.co.uk rss
] [http://s1.shard.jp/frhorton/u4h18i4kg.html african american celebrity hair product
] [http://s1.shard.jp/losaul/polo-photography.html advertising standards board australia
] [http://s1.shard.jp/olharder/autoroll-654.html url] [http://s1.shard.jp/bireba/nortons-antivirus.html nortons antivirus 2005 activation crack] [http://s1.shard.jp/losaul/job-search-cairns.html genes reunited australia
] [http://s1.shard.jp/galeach/new165.html asian food center new jersey
] [http://s1.shard.jp/losaul/moosehead-beer.html australian aboriginies
] [http://s1.shard.jp/bireba/antivirus-avg7.html nortons antivirus crack
] [http://s1.shard.jp/losaul/2004-australian.html money transfer uk australia
] [http://s1.shard.jp/galeach/new186.html map of asia for kids
] [http://s1.shard.jp/bireba/antivirus-personal.html kaspersky antivirus cracks
] [http://s1.shard.jp/olharder/autoroll-654.html page] [http://s1.shard.jp/losaul/australia-credit.html australia credit teacher union] [http://s1.shard.jp/galeach/new25.html asia air fare
] [http://s1.shard.jp/bireba/mobile-antivirus.html top rated antivirus software 2005
] [http://s1.shard.jp/olharder/the-autobiography.html automotive electrical diagrams
] [http://s1.shard.jp/frhorton/ds9o5dtz4.html umqombothi african beer] [http://s1.shard.jp/frhorton/dxtxzjkte.html south african people and culture
] [http://s1.shard.jp/galeach/new30.html south asia tribune proxy server
] [http://s1.shard.jp/olharder/auto-emissions-test.html insurance automobile
] [http://s1.shard.jp/olharder/auto-calculator.html chicago auto show tickets free
] [http://s1.shard.jp/bireba/update-norton.html avg6 antivirus
] [http://s1.shard.jp/losaul/medical-textbooks.html medical textbooks australia] [http://s1.shard.jp/bireba/stinger-antivirus.html english updates for norton antivirus virus defenitions
] [http://s1.shard.jp/bireba/escan-antivirus.html kasperski antivirus program
] [http://s1.shard.jp/galeach/new78.html tales of phantasia psx english patch
] [http://s1.shard.jp/bireba/alarm-antivirus.html symantec antivirus client removal tool
] [http://s1.shard.jp/frhorton/9mxpl8xy1.html usa embasy south africa
] [http://s1.shard.jp/frhorton/54k2pi876.html african orphanage
] [http://s1.shard.jp/galeach/new128.html make up tips for asian skin
] [http://s1.shard.jp/losaul/australian-cancer.html dave matthews band tour australia
] [http://s1.shard.jp/bireba/northon-antivirus.html norton antivirus 2005 download free
] [http://s1.shard.jp/galeach/new119.html kaveh afrasiabi harvard
] [http://s1.shard.jp/bireba/panda-free-antivirus.html mdaemon antivirus
] [http://s1.shard.jp/losaul/australia-transcriber.html australia v8 supercars
] [http://s1.shard.jp/olharder/automobile-essai.html autodromo bellezas
] [http://s1.shard.jp/bireba/antivirus-free-download.html nod32 antivirus serial
Line 88: Line 43:
$key = “This encrypting key should be long and complex.”;
$key = “This encrypting key should be long and complex.;
$encrypted_data = mcrypt_ecb (MCRYPT_3DES, $key, “12345”, MCRYPT_ENCRYPT);  //encrypt using triple DES
$encrypted_data = mcrypt_ecb (MCRYPT_3DES, $key, “12345”, MCRYPT_ENCRYPT);  //encrypt using triple DES
$id = urlencode(base64_encode($encrypted_data));
$id = urlencode(base64_encode($encrypted_data));

Revision as of 06:50, 3 June 2009

This is a control. To view all control, please see the Control Category page.

Often, we need to pass information from one page to another. The data can be passed with POSTs or GETs from a <Form>, or as key/value pairs in a URL that the user clicks on.

This section talks about how to protect the data that we are transferring from tampering. A few methods can be implemented.

The most straight forward method is to check the input for validity. If we expect the input data to contain only numbers, then we can check the input to verify that it contains only numeric data. While these validity checks are good for preventing unexpected program behavior, (i.e. a database query fails because it was expecting the id variable to be an integer) it does not protect against tampering.

Hashing sensitive data

Hashing algorithims provide a simple way to detect tampering. For instance, when passing an id variable from page to page as a user is browsing, the program may expect that this id stays constant. By computing and sending a hash of the data, each successive page can verify, with a high certanty, that the value of the id variable has not been altered:

$secret = 'MySecretWords';
$id = 12345;
$hash = md5($secret . $id);

After hashing the id value with the secret, we get a hash value. This will be passed, along with the id value, to the next page for processing:


In view_profile.php, we can detect tampering with the id value by re-hashing and comparing to the hash value from the previous page:

$secret = 'MySecretWords';
$id = $_REQUEST["id"]; //in this case the value is 12345
if (md5($secret . $id) == $_REQUEST["hash"]) {
  //no tampering detected, proceed with other processing
} else {
  //tampering of data detected

There is a disadvantage to using the hashing method discussed above; the value of id is visible to potentially malicious users. However, as long as the secret and the process for generating the hash (in this case, md5 is the hash algorithm, and the value hashed is the concatenation of $secret and $id) are unknown, malicious users will not be able to tamper with the id variable passed to the page.

Encrypting sensitive data

Next, we will discuss how we can use symmetric keys to protect sensitive data and at the same time do not reveal the actual data value.

The concept is very similar to hashing the value, but now instead we will use a symmetric key to encrypt and decrypt the data.

$key = “This encrypting key should be long and complex.”;
$encrypted_data = mcrypt_ecb (MCRYPT_3DES, $key, “12345”, MCRYPT_ENCRYPT);  //encrypt using triple DES
$id = urlencode(base64_encode($encrypted_data));

The id will be base64 encoded and then urlencoded into Doj2VqhSe4k%3D so we will have the url as


(For perl programmer, you can use Digest::MD5 and Crypt::CBC to archive the same output)

To decrypt the information we received we will do the following:

$id = $_REQUEST["id"]);
$url_id = base64_decode(urldecode($id));

$decrypted_data = mcrypt_decrypt(MCRYPT_BLOWFISH,$key,$url_id, MCRYPT_MODE_CBC, $iv);

The idea here is to url decode the input id value and follow by base64_decode it and then use back the same algorithm to get the actual data, which is 12345 in this case.

This same idea can be used on session id to make sure the session id is not tampered with. One caveat to take note is encrypting and decrypting all data send and receive will possibly consume lot of cpu power, so make sure your system is properly size up.