Codereview-Authorization - Revision history

Jmanico at 22:32, 26 February 2016

2016-02-26T22:32:39Z

2010-11-23T17:27:38Z

update to good code example. In Java strings should be compared with .equals not ==

2010-09-09T15:53:31Z

Added navigation to facilitate sequential reading online

2009-01-25T23:39:43Z

‎Good Example

2009-01-25T23:38:52Z

‎Vulnerable Patterns for Authorization Issues

2009-01-25T23:37:54Z

‎How to Locate the Potentially Vulnerable Code

2009-01-16T13:54:40Z

‎Good Example

2009-01-16T13:54:25Z

‎ASP.NET: (web.config)

2009-01-16T13:54:11Z

‎Vulnerable Patterns for Authorization Issues

2009-01-11T14:14:34Z

‎Related Vulnerabilities

← Older revision		Revision as of 22:32, 26 February 2016
Line 131:		Line 131:

	[[Category:OWASP Code Review Project]]		[[Category:OWASP Code Review Project]]
−	[[Category:~~Authorization~~]]	+	[[Category:Access Control]]

@@ Line 84: / Line 84: @@
   String action = request.getParameter("action")
-  if (action == "doStuff"){
+  if (action.equals("doStuff")){
     boolean permit = session.authTable.isAuthorised(action); // check table if authoirsed to do action
+  }

@@ Line 1: / Line 1: @@
-[[OWASP Code Review Guide Table of Contents]]__TOC__
+{{LinkBar
-[[Category:OWASP Code Review Project]]
+  | useprev=PrevLink | prev=Codereview-Authentication | lblprev=Authentication
 ==Introduction==
@@ Line 119: / Line 123: @@
 *[[Reviewing Code for Race Conditions]]
 In a multi user, multi-threaded environment thread safety is important as one may obtain another individuals session in error.
 [[Category:OWASP Code Review Project]]
 [[Category:Authorization]]

← Older revision		Revision as of 23:39, 25 January 2009
Line 91:		Line 91:

	'''Authorization being performed upon all requests from external entities'''		'''Authorization being performed upon all requests from external entities'''
		+
	[[Image:Authorisation.jpg]]		[[Image:Authorisation.jpg]]

← Older revision		Revision as of 23:38, 25 January 2009
Line 33:		Line 33:

	document.form.adminfunction.disabled=true;		document.form.adminfunction.disabled=true;
−
	<form action="./doAdminFunction.asp">		<form action="./doAdminFunction.asp">

@@ Line 13: / Line 13: @@
 ===How to Locate the Potentially Vulnerable Code ===
-Business logic errors are key areas in which to look for authorization errors. Areas wherein authorization-checks are performed are worth looking at. Logical conditional cases are areas for examination, such as malformed logic:
+Business logic errors are key areas in which to look for authorization errors. Areas where authorization checks are performed are worth looking at. Logical conditional cases are areas for examination, such as malformed logic:
   if user.equals("NormalUser"){

@@ Line 45: / Line 45: @@
 The <authorization> element controls ASP.NET URL authorization and the accessibility to gain access to specific folders, pages, and resources by users/web clients. Make sure that only authenticated users are authorized to see/visit certain pages.
   <system.web>
@@ Line 52: / Line 51: @@
    </authorization>
   </system.web>
 The roleManager Element in ASP.NET 2.0 is used to assist in managing roles within the framework. It assists the developer as not as much bespoke code needs to be developed. In web.config, to see if it is enabled check:

← Older revision		Revision as of 13:54, 16 January 2009
Line 41:		Line 41:

	'''The Database:''' The account used by the application to access the database. Ensure least privilege is in effect.		'''The Database:''' The account used by the application to access the database. Ensure least privilege is in effect.
−

	==ASP.NET: (web.config)==		==ASP.NET: (web.config)==

@@ Line 104: / Line 104: @@
 Common enough error. If a user has the URL, the functionality can still be called. This is due to no authorization check being performed upon every HTTP request.
-===Related Vulnerabilities===
+==Related Vulnerabilities==
 *[[Reviewing Code for OS Injection]]