ansaurus

Question

RedirectMode in ASP.NET Security Vulnerability

Answer 1

A:

Why only 3.5 SP1 and above? Because the attribute didn't exist before then.

Setting the attribute changes the way in which the error page renders. The default value (ResponseRedirect) causes the server to issue a redirect to the error page. The suggested value of ResponseRewrite causes the response to be written back instead of the requested content - without redirecting the user to a different Uri. At least, that's what I understand of it.

The MSDN documentation for the attribute is here...

Dan Puzey 2010-09-20 14:59:19

Answer 2

+1 A:

The ResponseRedirect gives to the attacker the information for the time to take to give the redirect header.

The ResponseRewrite did not return redirect header, so the attacker did not know this time.

Attacker can use this delay time to find what kind of error is, for that reason Scott give an error.aspx page example with a random delay. If you not use the ResponceRewrite then this delay is pointless.

Why only 3.5 SP1 and above because is not exist on previous version.s

Aristos 2010-09-20 15:00:20

+1 I'll just add that ResponseRewrite is **also** susceptible to timing attacks, but the link pasted by the OP suggests adding a default delay to prevent the timing attack. With ResponseRedirect, there is no easy way to prevent timing attacks.

sri 2010-09-20 15:05:25

Couldn't you just put the random sleep inside the global.asax Application_Error event? Then you don't give away any timing information on the side and thus do not need ResponseRewrite.

Aaron D 2010-09-20 22:18:05

@Aaron I do not know to answer on that because I need to test it first. Maybe yes, but Scott give a general easy way to protect from this attack. This is not the only think that you need to do to protect your self.

Aristos 2010-09-21 06:44:51

ansaurus

tags:

views:

answers:

RedirectMode in ASP.NET Security Vulnerability

related questions