|
|
| (17 intermediate revisions by 3 users not shown) |
| Line 2: |
Line 2: |
| | <div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:Cheatsheets-header.jpg|link=]]</div> | | <div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:Cheatsheets-header.jpg|link=]]</div> |
| | | | |
| − | {| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| + | The Cheat Sheet Series project has been moved to [https://github.com/OWASP/CheatSheetSeries GitHub]! |
| − | | valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |
| |
| − | Last revision (mm/dd/yy): '''{{REVISIONMONTH}}/{{REVISIONDAY}}/{{REVISIONYEAR}}'''
| |
| − | = DRAFT DOCUMENT - WORK IN PROGRESS =
| |
| | | | |
| − | = Introduction =
| + | Please visit [https://cheatsheetseries.owasp.org/cheatsheets/Transaction_Authorization_Cheat_Sheet.html Transaction Authorization Cheat Sheet] to see the latest version of the cheat sheet. |
| − | __TOC__{{TOC hidden}}
| |
| − | | |
| − | Some applications use second factor to check whether sensitive operations are being performed by an authorized user. Common example is wire transfer authorization, typically used in internet or mobile banking applications. For the purpose of this document we will call such process: “transaction authorization”. However, usage scenarios are not only limited to financial systems. For example: an e mail with a secret code or a link with some kind of token to unlock user account is also a special case of transaction authorization. User authorizes operation of account unlocking by using second factor (a unique code sent to his email address).
| |
| − | | |
| − | Transaction authorization is currently performed by various methods. The following are common examples: | |
| − | | |
| − | * cards with transaction authentication numbers (TAN),
| |
| − | * time based OTP tokens, such as SecureID,
| |
| − | * OTP sent by SMS, provided by phone or sent to email address,
| |
| − | * digital signature using a smart card,
| |
| − | * challenge-response tokens (including “disconnected card readers” or solutions which scan transaction data from computer screen).
| |
| − | | |
| − | Some of these can be implemented on a physical device or in a mobile application.
| |
| − | | |
| − | Transaction authorization is implemented in modern financial systems in order to protect against unauthorized wire transfers as a result of attacks using malware, phishing, password or session hijacking, CSRF, XSS and other. Unfortunately, as with any piece of code, such protection can be improperly implemented and as a result it might be possible to bypass this safeguard. Purpose of this cheat sheet is to provide guidelines on how to properly implement transaction authorization to protect it from bypassing.
| |
| − | | |
| − | = Authors and Primary Editors =
| |
| − | | |
| − | | |
| − | | |
| − | | valign="top" style="padding-left:25px;width:300px;border-right: 1px dotted gray;padding-right:25px;" |
| |
| − | | |
| − | == Other Cheatsheets ==
| |
| − | | |
| − | {{Cheatsheet_Navigation_Body}}
| |
| − | | |
| − | |}
| |
| − | | |
| − | [[Category:Cheatsheets]]
| |
