views:

42

answers:

3

I have an application that can be used without authentication on computers in public locations. It's a simple four page application that allows users to apply for a marriage license. Some offices will have a public computer kiosk where applicants can fill out their own information before proceeding to the clerk. They can also do so at home before visiting the office. What considerations should I take to make sure that a user cannot get access to the previous user's input? Some form data will contain sensitive info such as DOB, SSN and Mother's Maiden Name.

1. Disable AutoComplete

So far, I've set autocomplete=false in my Master page form tag.

<form id="frmMain" runat="server" autocomplete="false">

2. Disable Page Caching

I've also been able to disable page caching in IE and FF, but cannot do so in Safari and Chrome. Anybody know the trick? Hitting the back button still shows the form-filled data in Safari and Chrome.

// Disables page-caching in IE
Response.Cache.SetAllowResponseInBrowserHistory(false);
Response.Cache.SetCacheability(HttpCacheability.NoCache);
Response.Cache.SetNoStore();
Response.Expires = 0;

// HACK: fixes Firefoxes cache issue
Response.AddHeader("ETag", new Random().Next(1111111, 9999999).ToString());

3. Manage the session

I've also implemented a timer on each page that will kill the session after n number of minutes. The session holds the current application ID with which the pages use to load previously entered data. They can get more time by clicking a button. When the timer is up, it redirects back to the main page where I kill the session in Page_Load. I also redirect to this page when the users click the "Finished/Submit" button. Once the session is killed, navigating to the pages by URL will never load the previous application. It'll be treated as a new one.

protected void Page_Load(object sender, EventArgs e)
{
   if (!IsPostBack)
     Session.Abandon();
}

4. what else should I do?

Your awesome suggestions/tips here
A: 

Here you are: What should a developer know before building a public web site

Giorgi
Thanks, I've read that post. But I think there's a distinct difference between a website being publicly available and a website being available on a public computer. The latter is where I'm more concerned with security issues.
Jason Butera
A: 

I think you have the right idea. Killing the session on "finish/submit" is what I would have recommender. Still read over the owasp top 10 and keep your usual vulnerabilities in mind.

1)Make sure you use HTTPS.

2) Always always always test your application for vulnerabilities before rolling it out. I recommend using Wapiti(free), Acunetix($) or NTOSpider($$$$).

3) Keep your server up to date, make sure you run OpenVAS to make sure your server is secure.

Rook
Thanks Rook. The app will be hosted HTTPS. The session kill is working nicely. However, I'm really frustrated with Chrome and Safari because I can seem to stop the page from caching and retaining the form data. If the window is closed and the page is accessed from the history, I'm cool. But if the page isn't closed and they grab the page from the Back button, the form values stick.
Jason Butera
@Jason Butera you can clear out all of the `<input>`'s when the page loads using javascript.
Rook
Yeah, but the user is allowed to revisit that page in his/her session and the data loaded in Page_Load from the session license ID will then be wiped.
Jason Butera
@Jason Butera, well then add a very simple xmlhttprequest check to see if the session is still valid.
Rook
Rook, that is exactly what we came up with as well. Basically, comparing the sessionID originally loaded with the page to the existing one.
Jason Butera
Are you kidding me? Safari won't run any window.load() or document.ready() script when loaded via the back button!!!
Jason Butera
@Jason Butera lol safari is crap, try a `<body onLoad="alert(/js/)">`
Rook
Thanks Rook. Once I added $(window).load(function () { ...my session ID comparison code... }); $(window).unload(function () { });everything works in all four browsers (IE, FF, Chrome, Safari). Thanks for the help.
Jason Butera
@Jason Butera cool, your welcome. So I get the check mark but no +1? (also if you put @ and their name it will make sure the message shows up on their end)
Rook
+1  A: 

Since this is a Kiosk app, you'd want to make sure that the browser is configured to honor requests to not cache anything.

Last time I researched the effectiveness of server side no-cache headers, I realized that any one using customized, buggy or uncommon browser might not be honor requests to not cache documents.

You may also want to add javascript back-button breakers on some pages (e.g. some end of session page) and a history navigation deterrent, but not all pages because no one like the back button to be broken.

MatthewMartin