Ajax and Other "Rich" Interface Technologies - Revision history

KirstenS: /* Access control: Authentication and Authorization */

2009-04-29T12:30:16Z

‎Access control: Authentication and Authorization

KirstenS: /* Access control: Authentication and Authorization */

2009-04-29T12:21:58Z

‎Access control: Authentication and Authorization

KirstenS: /* Accessibility */

2009-03-03T13:34:50Z

‎Accessibility

KirstenS: /* Accessibility */

2009-03-03T13:32:01Z

‎Accessibility

KirstenS: /* Privacy */

2009-03-02T20:01:27Z

‎Privacy

KirstenS: /* Privacy */

2009-03-02T19:58:04Z

‎Privacy

KirstenS: /* Privacy */

2008-08-26T12:03:03Z

‎Privacy

KirstenS: /* Access control: Authentication and Authorization */

2008-08-26T12:02:04Z

‎Access control: Authentication and Authorization

KirstenS: /* Access control: Authentication and Authorization */

2008-08-19T13:10:28Z

‎Access control: Authentication and Authorization

KirstenS: /* Reference */

2008-08-19T13:07:05Z

‎Reference

@@ Line 145: / Line 145: @@
 <pre>
-''<?php?  ''
+<?php?
-''function calculate_tax($sales_amount)''
+function calculate_tax($sales_amount)
-''{''
-''// check that the session is logged in ?''
+// check that the session is logged in ?
-''	assert_login();''
+	assert_login();
-''	// check that the user has the USER role to prevent ''
+	// check that the user has the USER role to prevent
-''// guest and admin access''
+// guest and admin access
-''	assert_role(‘USER’);''
+	assert_role(‘USER’);
-''// Validate data and business rules''
+// Validate data and business rules
-''if ( is_numeric($sales_amount) && $sales_amount > 0 )''
+if ( is_numeric($sales_amount) && $sales_amount > 0 )
-''{''
-''// Perform the calculation and return''
+// Perform the calculation and return
-''return($sales_amount * 0.075);?''
+return($sales_amount * 0.075);?
-''}''
-''// Data failed validation and business rules''
+// Data failed validation and business rules
-''return -1;''
+return -1;
-''}''
-''?>''
+?>
 </pre>

@@ Line 129: / Line 129: @@
 <pre>
-''<?php?  ''
+<?php?
-''function calculate_tax($sales_amount)''
+function calculate_tax($sales_amount)
-''{''
-''return($sales_amount * 0.075);?''
+return($sales_amount * 0.075);?
-''}?''
+}?
-''?>''
+?>
 </pre>

@@ Line 507: / Line 507: @@
 '''How to identify if you are vulnerable '''
-* Read the W3C WAI guidelines and ensure your application has alternate accessible paths, and adheres to basic accessibility guidelines
+* Read the W3C WAI guidelines and ensure your application has alternate accessible paths, and adheres to basic accessibility guidelines.
-* Identify suitable evaluation tools for your development environment if it does not already contain them. Fix issues found by these tools and re-test
+* Identify suitable evaluation tools for your development environment if it does not already contain them. Fix issues found by these tools and re-test.
 * Try using the basic accessibility tools built into your operating system to see if your code works in high contrast, different color schemes, resize the text elements in your browser (in Firefox use Control-+ key to do this, Text Size -> Larger in Internet Explorer 6.0 or use the zoom control on the bottom right of the screen in IE 7), (Windows specific) set the font resolution to high DPI to emulate large fonts, choose big default fonts in the browser, use the screen magnification tool, and test various basic screen readers. If your application fails any of these tests, you are vulnerable.
-* Once you are satisfied your application should have a reasonable shot at passing full testing, identify a suitable accredited accessibility test firms or similarly qualified resources who can test your application using actual disability tools and provide qualified feedback. In general, unless your application is very simple, you should fix any issues found.
+* Once you are satisfied your application should have a reasonable shot at passing full testing, identify suitable accredited accessibility test firms or similarly qualified resources who can test your application using actual disability tools and provide qualified feedback. In general, unless your application is very simple, you should fix any issues found.
 '''Countermeasures '''
-* Develop with accessibility in mind. Just like security, the sooner you do it, the cheaper this activity becomes and the more likely your application will be accessible
+* Develop with accessibility in mind. Just like security, the sooner you do it, the cheaper this activity becomes and the more likely your application will be accessible.
 * Test in house regularly. If possible, employ staff or volunteers who require such accessibility; they will let you know the best choices for full featured screen readers, Braille devices, and magnification and other accessibility aides. Let them test your application and provide feedback.

@@ Line 497: / Line 497: @@
 ==Accessibility ==
-Almost all Ajax toolkits and applications are inaccessible. Rarely do they pass even basic W3C WAI validation, do not have accessible alternative paths. Some toolkits, such as Tibco General Interface, crash the browser if a larger text size is chosen. This is completely unacceptable and worse, completely preventable. Being a “rich” interface does not excuse disability requirements. Based upon the US Census conducted in 2000, around 19.1% of the total US population has a disability of some kind (with similar levels elsewhere on the planet). Locking out 20% of your potential users from using your application is unacceptable and is in fact, illegal in most countries.
+Almost all Ajax toolkits and applications are inaccessible. Rarely do they pass even basic W3C WAI validation, and do not have accessible alternative paths. Some toolkits, such as Tibco General Interface, crash the browser if a larger text size is chosen. This is completely unacceptable and worse, completely preventable. Being a “rich” interface does not excuse disability requirements. Based upon the US Census conducted in 2000, around 19.1% of the total US population has a disability of some kind (with similar levels elsewhere on the planet). Locking out 20% of your potential users from using your application is unacceptable and is in fact, illegal in most countries.
 Nearly all Western disability discrimination laws are the same – they require accessibility unless it is a justifiable hardship. They do not distinguish between open source or closed source, for profit or charitable, government or corporate – their application is universal.
@@ Line 521: / Line 521: @@
 * Test in house regularly. If possible, employ staff or volunteers who require such accessibility; they will let you know the best choices for full featured screen readers, Braille devices, and magnification and other accessibility aides. Let them test your application and provide feedback.
 * If you are likely to sell to corporate or government organizations, ensure that all applications are tested by an accredited accessibility testing firm. Fix all the issues they identify.
 ==Further Reading ==

@@ Line 310: / Line 310: @@
 <pre>
-''var cp = new cpaint();''
+var cp = new cpaint();
-''cp.set_transfer_mode(‘POST’);''
+cp.set_transfer_mode(‘POST’);'
-''…''
+…
-''cp.call(‘processCreditCard.php’, ‘setCCDetail’, document.getElementById(‘creditcardnumber’), document.getElementById(‘creditcardexpiry’),''
+cp.call(‘processCreditCard.php’, ‘setCCDetail’, document.getElementById(‘creditcardnumber’), document.getElementById(‘creditcardexpiry’),
-''document.getElementById(‘ccv’));''
+document.getElementById(‘ccv’));
-''CPaint POST transfer mode server example''
+CPaint POST transfer mode server example
-''<?php?  ''
+<?php?
-''function setCCDetail($cc, $expiry, $ccv)''
+function setCCDetail($cc, $expiry, $ccv)
-''{''
-''// check that the session is logged in ?''
+// check that the session is logged in ?
-''	assert_login();''
+	assert_login();
-''	// check that the user has the USER role to prevent ''
+// guest and admin access
-''// guest and admin access''
+	assert_role(‘USER’);
-''// Validate data and business rules''
+if ( is_credit_card($cc) && is_expiry_date($expiry) && is_numeric($ccv) )
-''if ( is_credit_card($cc) && is_expiry_date($expiry) && is_numeric($ccv) )''
-''{''
+// Set the credit card details
-''// Set the credit card details''
+$this->cc = $cc;
-''$this->cc = $cc;''
+$this->exp = $expiry;
-''$this->exp = $expiry;''
+$this->ccv = $ccv;
-''$this->ccv = $ccv;''
+return true;
-''return true;''
-''}''
+// Data failed validation and business rules
-''// Data failed validation and business rules''
+return false;
-''return false;''
-''}''
+?>
 </pre>

@@ Line 298: / Line 298: @@
 * Use a proxy tool, like Paros, Spike, or WebScarab to determine the mode of the Ajax interaction. If it is GET, you are potentially at risk.
-* Look at the data – does it contain details such as usernames, passwords, names, addresses, medical history, bank account, tax or other private details? If so, you are at risk.
+* Look at the data – does it contain details such as usernames, passwords, names, addresses, medical history, bank account, tax, or other private details? If so, you are at risk.
 * If you are sending sensitive data, can you access the Ajax endpoint via HTTP? If so, you are at risk from privacy breaches.

@@ Line 309: / Line 309: @@
+<pre>
 ''var cp = new cpaint();''
@@ Line 367: / Line 367: @@
 ''?>''
+</pre>

@@ Line 127: / Line 127: @@
 For example, in typical Ajax style, CPaint uses this insecure example:
 ''<?php?  ''
@@ Line 139: / Line 140: @@
 ''?>''
 Let’s add some session authentication, authorization and data validation, and business rule validation:
 ''<?php?  ''
@@ Line 181: / Line 184: @@
 ''?>''
 With these simple changes, we ensure that:

← Older revision		Revision as of 13:10, 19 August 2008
Line 102:		Line 102:

	==Access control: Authentication and Authorization ==		==Access control: Authentication and Authorization ==
		+	[[Category:FIXME\|Starting here, should these sections be part of this article? Or do they go somewhere else with links here?]]

	Ajax code uses the XMLHttpRequest object, which will send the cookies of the current browser context through with each request. For applications which have user sessions, it is vital that normal authentication paths are used to ensure that the caller is known to the application. Brochure-ware applications can skip this section as they allow anonymous calling.		Ajax code uses the XMLHttpRequest object, which will send the cookies of the current browser context through with each request. For applications which have user sessions, it is vital that normal authentication paths are used to ensure that the caller is known to the application. Brochure-ware applications can skip this section as they allow anonymous calling.

@@ Line 548: / Line 548: @@
 ==Reference==
-[[Guide Table of Contents]]
+[[Guide Table of Contents|Development Guide Table of Contents]]
 [[Category:OWASP_Guide_Project]]
 [[Category:OWASP AJAX Security Project]]
 [[Category:AJAX]]