Re: [C#] check I come from ...

Consider the following, which could be executed with a common browser:

1) An user browses to page A. The value "A" is stored in the session
item, to indicate the last browsed page.
2) She opens a new window, retaining the same session ID of the one in
the background.
3) In the newly created window she browses to page B. The value "B" is
now stored in the session.
4) Now the user focuses the first window and browses to page C.
5) Page C now reads the value stored in the session and it appears the
user is coming from page "B" where, in fact, she is coming from "C"...
Spoofed!

Hope this helps.

--
Efran Cobisi
http://www.cobisi.com

Shanmugam, Kris wrote:
> Session ID is stored on the client side and Session Content / Session
> Values are stored in-memory on the Server side. The value for
> Session["lastViewedPage"] cannot be spoofed unless the session itself is
> hijacked. Am I missing something?
>
> Kris
>
> -----Original Message-----
> From: Discussion of building .NET applications targeted for the Web
> [mailto:[email protected]] On Behalf Of Shanmugam, Kris
> Sent: Friday, May 11, 2007 9:36 AM
> To: [email protected]
> Subject: Re: [DOTNET-WEB] [C#] check I come from ...
>
> Are session values stored in a page? I was under the impression that
> only Session IDs are stored in a page. Am I wrong?
> Kris
>
> -----Original Message-----
> From: Discussion of building .NET applications targeted for the Web
> [mailto:[email protected]] On Behalf Of Efran Cobisi
> Sent: Friday, May 11, 2007 3:16 AM
> To: [email protected]
> Subject: Re: [DOTNET-WEB] [C#] check I come from ...
>
> Christopher,
>
>  From the security point of view, this solution is secure as the HTTP
> referer one.
> Users could open each one of the pages in different windows and spoof
> the value the last opened page has stored in the session.
>
> However, I'm still wondering if security is an issue for this problem.
> Gabriel, could you answer to this one?
>
> HTH
>
> --
> Efran Cobisi
> http://www.cobisi.com
>
> Christopher Frazier wrote:
>
>> Use Session["lastViewedPage"] or something like that. Just set it to
>>
> the
>
>> current page in the PreRender event, and check for the correct one in
>>
> Load.
>
>> --
>> -Christopher
>> | AspInsider
>> http://chrisfrazier.net/blog
>>
>>
>
> ===================================
> This list is hosted by DevelopMentor(r)  http://www.develop.com
>
> View archives and manage your subscription(s) at
> http://discuss.develop.com
>
> ===================================
> This list is hosted by DevelopMentor(r)  http://www.develop.com
>
> View archives and manage your subscription(s) at
> http://discuss.develop.com
>
> ===================================
> This list is hosted by DevelopMentor®  http://www.develop.com
>
> View archives and manage your subscription(s) at http://discuss.develop.com
>

===================================
This list is hosted by DevelopMentor®  http://www.develop.com

View archives and manage your subscription(s) at http://discuss.develop.com