COEN 350: Network Security E-Commerce Issues. Table of Content HTTP Authentication Cookies.

Slides:

Advertisements

Similar presentations

UFCE8V-20-3 Information Systems Development 3 (SHAPE HK)

Advertisements

Lecture 6/2/12. Forms and PHP The PHP $_GET and $_POST variables are used to retrieve information from forms, like user input When dealing with HTML forms.

Cryptography Chapter 7 Part 4 Pages 833 to 874. PKI Public Key Infrastructure Framework for Public Key Cryptography and for Secret key exchange.

Members Only & Login Modules Members Only works with the Login module to provide password protection to Web pages and files. Login Groups may be created.

The Elbert HTTP Server HTTP Authentication, providing security in tough times By: Shawn M. Jones.

The Basic Authentication Scheme of HTTP. Access Restriction Sometimes, we want to restrict access to certain Web pages to certain users A user is identified.

Web Security CS-431. HTTP Authentication Protect web content from those who don’t have a “need to know” Require users to authenticate using a userid/password.

Http Web Authentication Web authentication is used to verify a users identity before allowing access to certain web pages On web browsers you get a login.

Securing web applications using Java EE Dr Jim Briggs 1.

CC3.12 Lecture 12 Erdal KOSE Based of Prof. Ziegler Lectures.

WEB2P security Java web application security Dr Jim Briggs.

Chapter 9 Web Applications. Web Applications are public and available to the entire world. Easy access to the application means also easy access for malicious.

1 The World Wide Web. 2  Web Fundamentals  Pages are defined by the Hypertext Markup Language (HTML) and contain text, graphics, audio, video and software.

 Proxy Servers are software that act as intermediaries between client and servers on the Internet.  They help users on private networks get information.

Cookies COEN 351 E-commerce Security. Client / Session Identification HTTP does not maintain state. State Information can be passed using: HTTP Headers.

Web Application Vulnerabilities Checklist. EC-Council Parameter Checklist  URL request  URL encoding  Query string  Header  Cookie  Form field 

Ins and Outs of Authenticating Users Requests to IIS 6.0 and ASP.NET Chris Adams Program Manager IIS Product Unit Microsoft Corporation.

Networks and Security. Types of Attacks/Security Issues  Malware  Viruses  Worms  Trojan Horse  Rootkit  Phishing  Spyware  Denial of Service.

Session 11: Security with ASP.NET

Cookies Set a cookie – setcookie() Extract data from a cookie - $_COOKIE Augment user authentication script with a cookie.

CHAPTER 12 COOKIES AND SESSIONS. INTRO HTTP is a stateless technology Each page rendered by a browser is unrelated to other pages – even if they are from.

Comp2513 Forms and CGI Server Applications Daniel L. Silver, Ph.D.

Remotely authenticating against the Service Framework.

Lecture 14 – Web Security SFDV3011 – Advanced Web Development 1.

Chapter 9 Web Applications. Web Applications are public and available to the entire world. Easy access to the application means also easy access for malicious.

JavaScript, Fourth Edition

CSE 154 LECTURE 12: COOKIES. Including files: include include("filename"); PHP include("header.html"); include("shared-code.php"); PHP inserts the entire.

© FPT SOFTWARE – TRAINING MATERIAL – Internal use 04e-BM/NS/HDCV/FSOFT v2/3 Securing a Microsoft ASP.NET Web Application.

COMP3121 E-Commerce Technologies Richard Henson University of Worcester November 2011.

Chapter 8 Cookies And Security JavaScript, Third Edition.

12/3/2012ISC329 Isabelle Bichindaritz1 PHP and MySQL Advanced Features.

Week seven CIT 354 Internet II. 2 Objectives Database_Driven User Authentication Using Cookies Session Basics Summary Homework and Project 2.

Lecture 8 – Cookies & Sessions SFDV3011 – Advanced Web Development 1.

_______________________________________________________________________________________________________________ E-Commerce: Fundamentals and Applications1.

Top Five Web Application Vulnerabilities Vebjørn Moen Selmersenteret/NoWires.org Norsk Kryptoseminar Trondheim

Protecting Students on the School Computer Network Enfield High School.

1 Chapter 9 – Cookies, Sessions, FTP, and More spring into PHP 5 by Steven Holzner Slides were developed by Jack Davis College of Information Science.

Internet Security. 2 PGP is a security technology which allows us to send that is authenticated and/or encrypted. Authentication confirms the identity.

1 Security Protocols in the Internet Source: Chapter 31 Data Communications & Networking Forouzan Third Edition.

Module 11: Securing a Microsoft ASP.NET Web Application.

Dynamic Programming with PHP (mktime), Cookies, SQL, Authentication.

Web Database Programming Week 7 Session Management & Authentication.

Cookies and Sessions IDIA 618 Fall 2014 Bridget M. Blodgett.

Ins and Outs of Authenticating Users Requests to IIS 6.0 and ASP.NET Chris Adams Program Manager IIS Product Unit Microsoft Corporation.

CS 4244: Internet Programming Security 1.0. Introduction Client identification and cookies Basic Authentication Digest Authentication Secure HTTP.

All Rights Reserved © Alcatel-Lucent 2006, ##### 2G IMS CAVE Based Security Replay Protection Alec Brusilovsky, Zhibi Wang Alcatel-Lucent, July 24, 2007.

© 2010 Computer Science Faculty, Kabul University HTTP CONTINUED… 4 TH LECTURE 2, May, 2010 Baseer Ahmad Baheer.

Cookies Bill Chu. © Bei-Tseng Chu Aug 2000 Definition A cookie is a TEXT object of max 4KB sent from a web server to a browser It is intended for the.

Saving State on the WWW. The Issue  Connections on the WWW are stateless  Every time a link is followed is like the first time to the server — it has.

Cookies COEN 351 E-commerce Security. Client / Session Identification HTTP Headers Client IP Address HTTP User Login FAT URLs Cookies.

PHP Secure Communications Web Technologies Computing Science Thompson Rivers University.

All Rights Reserved © Alcatel-Lucent 2006, ##### 2G IMS CAVE Based Security Replay Protection Zhibi Wang January, 2007.

ECMM6018 Enterprise Networking for Electronic Commerce Tutorial 7

Web2.0 Secure Development Practice Bruce Xia

1 State and Session Management HTTP is a stateless protocol – it has no memory of prior connections and cannot distinguish one request from another. The.

PHP and Sessions. Session – a general definition The GENERAL definition of a session in the “COMPUTER WORLD” is: The interactions (requests and responses)

ITM © Port,Kazman 1 ITM 352 Cookies. ITM © Port,Kazman 2 Problem… r How do you identify a particular user when they visit your site (or any.

©SoftMooreSlide 1 Cookies. ©SoftMooreSlide 2 Cookies Basic idea –web application sends a simple name/value pair to the client –when the client connects.

Session Management Tyler Moore CS7403 University of Tulsa Slides adapted in part or whole from Dan Boneh, Stanford CS155 1.

Cookies and Sessions in PHP. Arguments for the setcookie() Function There are several arguments you can use i.e. setcookie(‘name’, ‘value’, expiration,

Unit-6 Handling Sessions and Cookies. Concept of Session Session values are store in server side not in user’s machine. A session is available as long.

Session 11: Cookies, Sessions ans Security iNET Academy Open Source Web Development.

Security Management in Web Applications. We all know this page...

CS520 Web Programming Declarative Security (I) Chengyu Sun California State University, Los Angeles.

Authentication & .htaccess

Chapter 8 Building the Transaction Database

Cross-Site Request Forgeries: Exploitation and Prevention

Using SSL – Secure Socket Layer

What is Cookie? Cookie is small information stored in text file on user’s hard drive by web server. This information is later used by web browser to retrieve.

Web Server Design Week 11 Old Dominion University

Presentation transcript:

COEN 350: Network Security E-Commerce Issues

Table of Content HTTP Authentication Cookies

HTTP Authentication HTTP Basically very simple. GET:Used to read a website. POST: Sends data to a website. Some data has security implications FROM field contains . But not by default, only if browser is configured that way. Used for spiders (crawlers) so that admins can complain about spider behavior.

HTTP Authentication HTTP Some data has security implications AUTHORIZATION field: Contains authentication data. COOKIE field: See below REFERRER (REFERER) field: Contains the URL of the page from which the client came.

HTTP Authentication Authentication URL allow username / password data. HTTP1.1 has two authentication mechanisms. Can use SSL, integrated as HTTPS.

HTTP Authentication URL Authentication

HTTP Authentication URL authentication Can be abused in phishing expeditions.

HTTP Authentication Native HTTP provides a challenge / response framework.

HTTP Authentication HTTP authenticator: A base 64 username / password encoding: The username and the password in the base 64 encoding Completely insecure. Data is not humanly readable It is easy to decode. Even easier to replay authorization

HTTP Authentication HTTP authenticator: Digest Authentication Challenge includes The WWW-Authenticate field reads "Digest". The realm field gives the authentication realm. The nonce field contains a value to be used as a nonce. The opaque field contains a value that the server needs the client to pass back to it unchanged. The stale field indicates whether the previous request was denied because the nonce was stale. The algorithm field specifies the hash algorithm to be used, typically MD5. The qop or quality of protection field can contain the value "auth" for authentication only or the value "auth- int" for both authentication and integrity protection.

HTTP Authentication HTTP authenticator: Digest Authentication Response includes challenge values and Client nonce Digest Calculated by hash algorithm requested. From challenge data, username, password, client nonce. (This prevents someone spoofing the server to control all data in the digest.)

Cookies HTTP is stateless. Good for requesting resources. Bad if server needs to update state based on clients actions. Fat URLs change server state. Cookies maintain state at client site. E-commerce integrates both.

Cookies How cookies work: Client contacts server. Server includes cookie in answer. “Slapping a cookie”. Client stores cookie in cookie jar. Client goes to the same website: Browser passes unexpired cookies along.

Cookies Cookies: Permanent cookies Valid for more than a single transaction. Session cookies Deleted when browser is closed.

Cookies Contain domain field. Example: Alice visits scu.edu slams her with Set-cookie: user="Alice"; domain="scu.edu“ Alice visits cse.scu.edu Browser includes the cookie in header of request because it matches the domain.

Cookies Domain field Specifies to whom cookies will be sent. Limited to specific sites. E.g..com.ft or.edu is not allowed. Path field Limits cookie sending to a given path. path = “

Cookies Cookie Versions Netscape Cookies= Version 0 Cookies RFC 2965 Cookies = Version 1 Cookies RFC 2965 : HTTP State Management Mechanism.

Cookies Version 0 cookies Set-Cookie: name=value [; expires=date] [;path=path] [;domain=domain] [;secure]. Secure: only include this cookie with HTTPS (i.e. with SSL) requests.

Cookies Web Bugs Web page can contain URL addressed resources. Web bug: Typically 1 by 1 image. Hence invisible. Ad from Ad server. Browser goes to the URL specified. Sends along cookies belonging to that URL Referrer field contains the referring URL.

Cookies Spying Cookies

Cookies Unprotected Cookies Servers need to protect themselves against users altering cookies. Plain text cookies are simple to forge. Change state information such as prices of items in a shopping cart. Gain unauthorized access by changing the user-id. Encryption of cookies needs to be understood and strong.