Servlet Parameter Encryption

Question

Hi,

Still learning JSP Web Applications here.

I have been doing this for a while in my web application but I would like to know a more secured solution.

Imagine a Table that displays certain Book Information. When user clicks one of the rows in the table, I basically send the BookID together with the url.

Example URL. http://locathost:8080/myapp/editbook.htm?bookID=3

in my servlet.

String strBookID = request.getParameter("bookID");

I think this is a little weak, is there a way where I could provide a more secure way other than this. Its quite easier for hacker to edit the URL if I send the BookID together with the URL.

Can you share me some link on how to do this in both the Client Side and Server Side?

Thanks

Answer 1

You have to suppose that any user can send anything to you. The solution isn't avoiding users to send data in URL, it's to control that they can in fact do the following operation.

You need authentication and authorizations.

How to use authentication with your web.xml

Defining Security Requirements for Web Applications

Answer 2

I think this is a little weak, is there a way where I could provide a more secure way other than this.

You have to define "secure" on the basis of your application. The requirements are totally different for a public website selling books v/s a private library hosting confidential volumes v/s anything other application in between.

At a minimum, you should do the following -

1. Verify that bookID is in fact an Integer and is within an expected range.
2. Ensure that you bind bookid in a parameterized SQL Query - this is to prevent SQL Injection.
3. Show a 'Book not found' page if the book cannot be found

For a public website, the above is enough. You actually want people to discover your books, so if someone modifies the bookID, you shouldn't care.

For a secure library, you have to do a lot more.

1. Ensure that the URL is protected in web.xml, so only authenticated and authorized users can get to the URL
2. Verify the current user has access to the bookID. You can store the list of books available to a user in the session object.
3. If the user does not have access, return a 403 error page.

There are several other strategies to protect URLs; some use tokens to ensure the URL hasn't been manipulated. Others don't send bookID to the client, and instead rely on number {1 through n} where only the server knows that 1 corresponds to Book A and so on. But the idea is to ensure that a user doesn't get access to a book he doesn't have permissions to.

If you are using Spring, I'd highly recommend Spring Security. Otherwise look into JAAS.