Can I find out if the postback came from the same server?

[Alan Silver]

Hello,

Reading articles on the various forms of attack that people try against
web sites, it seems that a lot of them involve people modifying a page
and posting it back to the server. Thus, if you had some way of checking
(on postback) if the postback had come from the server on which the page
is running, you would be a long way to avoiding these attacks.

For example, if you could have (pseudocode)...

void Page_Load(object o, event e) {
if (!FromMyServer) {
// display message "Don't try and hack my site!!" or similar
} else if (!PostBack) {
// initialise controls, etc
}
}

Offhand, the only way I can think of doing such a check is from the
HTTP_REFERER server variable, but as that is pretty easy to hack, it
doesn't really help.

Any comments?

--
Alan Silver
(anything added below this line is nothing to do with me)

[Mr Newbie]

Read this article, it will go a long way towards helping you understand some
of the pitfalls and workarounds.

http://msdn.microsoft.com/library/de...tybarriers.asp
Best Regards

The Inimitable Mr Newbie º¿º
"Alan Silver" <al*********@nospam.thanx> wrote in message
news:OQ**************@nospamthankyou.spam...

Hello,

Reading articles on the various forms of attack that people try against
web sites, it seems that a lot of them involve people modifying a page
and posting it back to the server. Thus, if you had some way of checking
(on postback) if the postback had come from the server on which the page
is running, you would be a long way to avoiding these attacks.

For example, if you could have (pseudocode)...

void Page_Load(object o, event e) {
if (!FromMyServer) {
// display message "Don't try and hack my site!!" or similar
} else if (!PostBack) {
// initialise controls, etc
}
}

Offhand, the only way I can think of doing such a check is from the
HTTP_REFERER server variable, but as that is pretty easy to hack, it
doesn't really help.

Any comments?

--
Alan Silver
(anything added below this line is nothing to do with me)

[Alan Silver]

>Read this article, it will go a long way towards helping you understand some

of the pitfalls and workarounds.

http://msdn.microsoft.com/library/de.../en-us/dnaspp/
html/securitybarriers.asp
Thanks for the link. The article was useful, but still didn't address
the point I raised. If you had some way of checking that the postback
had come from the same server, you would avoid quite a number of the
attacks in the first place. Several of the ones mentioned involved
posting from another server. If you simply disallowed these, you would
cut out a number of possible attacks without any further work. Obviously
you would still have plenty to do protecting yourself from other kinds
of attack.

Which brings me back to my original question, is there a reliable way of
checking if the postback came from the same server?
Best Regards

The Inimitable Mr Newbie º¿º
"Alan Silver" <al*********@nospam.thanx> wrote in message
news:OQ**************@nospamthankyou.spam...

Hello,

Reading articles on the various forms of attack that people try against
web sites, it seems that a lot of them involve people modifying a page
and posting it back to the server. Thus, if you had some way of checking
(on postback) if the postback had come from the server on which the page
is running, you would be a long way to avoiding these attacks.

For example, if you could have (pseudocode)...

void Page_Load(object o, event e) {
if (!FromMyServer) {
// display message "Don't try and hack my site!!" or similar
} else if (!PostBack) {
// initialise controls, etc
}
}

Offhand, the only way I can think of doing such a check is from the
HTTP_REFERER server variable, but as that is pretty easy to hack, it
doesn't really help.

Any comments?

--
Alan Silver
(anything added below this line is nothing to do with me)

--
Alan Silver
(anything added below this line is nothing to do with me)

[PL]

> Which brings me back to my original question, is there a reliable way of checking if the postback came from the same server?

I assume you are aware of the eventvalidation feature of ASP.NET 2.0 ?

Event validation ensures the postback comes from the control that orginally
rendered it, meaning for example that if you have a datagrid with edit buttons
and those buttons are wired into calling "ItemEdit" it will validate the events
to make sure it came from the control that orginally rendered it.

This is not really 100% but it goes a long way to protect against the type
of attacks you are talking about.

PL.

[Alan Silver]

>> Which brings me back to my original question, is there a reliable way

of checking if the postback came from the same server?
I assume you are aware of the eventvalidation feature of ASP.NET 2.0 ?

You assume incorrectly!! I am ignorant ;-)
Event validation ensures the postback comes from the control that orginally
rendered it, meaning for example that if you have a datagrid with edit buttons
and those buttons are wired into calling "ItemEdit" it will validate the events
to make sure it came from the control that orginally rendered it.
If so, how do the attacks that rely on saving a page, modifying it and
posting back from another server work? Surely the eventvalidation would
catch this?

Or did I miss the point?

Actually, re-reading your words, it looks like the check is to ensure
that the event is called from the control that is supposed to call it.
If so, then it could easily be from another server, as long as the name
of the control in the saved page wasn't changed.

Or did I still miss the point?
This is not really 100% but it goes a long way to protect against the type
of attacks you are talking about.

I would be grateful if you could explain it a little more, as I'm not
very clear so far<g>

Also, is this something built in to ASP.NET, or do you have to do
something to enable it?

Thanks for the reply

--
Alan Silver
(anything added below this line is nothing to do with me)

[PL]

> If so, how do the attacks that rely on saving a page, modifying it and posting back from another server work? Surely the

eventvalidation would catch this?
If it's modified I think it will.
Actually, re-reading your words, it looks like the check is to ensure that the event is called from the control that is supposed
to call it. If so, then it could easily be from another server, as long as the name of the control in the saved page wasn't
changed.
I'm not 100% sure how it works but it puts a hidden field named
__EVENTVALIDATION in the form with a hash of the unique id's
from the controls rendered on the page.

This value is verified at postback, not sure what would happen if you save
the complete page and put it up on a separate server.
Also, is this something built in to ASP.NET, or do you have to do something to enable it?

It's new in ASP.NET 2.0 and turned on by default, to turn it off you use
<page enableEventValidation="False"> in the web.config or put
enableEventValidation="False" in the @Page tag for an individual page.

I'm having a hard time finding any good articles about this subject but
ASP.NET 2.0 is still just a few weeks old (RTM version).

PL.