Re: Form submit hash keys

Marcel van der Boom wrote:
> 23-02-2009 11:44]:Jason wrote:
>> Instead, would it make sense to just redisplay the page, with the
>> submitted data
>> intact, and a message to telling the user that their data was*not* 
>> submitted
>> and to try again?
> 
> "... with submitted data intact,... their data was *not* submitted.."
> 
> I'm sure that is not literally what you mean. How do you have the
> redisplaying in mind?

I wasn't clear. I meant that the attempted-to-submit data is displayed in the
form, i.e. there was an attempt to submit it - whether on purpose or via a dodgy
 hacker's URL - so that data was *submitted* to the server, but was not accepted
due to an incorrect or missing hash key.

> the hash key, as we use it, just confirms that the form exit point
> (submit) pairs up with the entry point (generating it), so we get the
> two phase submit. If those two phases still pair up, security is not
> affected.

Yes, the approach I think we should have, is - if the entry and exit points do
not match up - is to basically create a new entry point and give the user
another chance to submit the form. The point is not to dump them into an error
page and discard all their data.

I'm sure for every attempted cross-site 'session riding' link that is clicked on
(which is probably extremely rare anyway, why attack a system protected from
such attacks?) there are a thousand cursing users who have lost a page full of
data they just typed up.

-- Jason