URL Querystring security question (ASP.NET)

Question

If a user clicks on a button that does a post (lets say it has UserName and Password in the post) and those credentials get authenticated successfully. If I did a redirect to a completely different application (so I can't carry session, etc) and I use a GET with the Username and Password in the querystring (I could even use basic encryption if that helps but regardless) and then when it gets to the page, I check to make sure it came from the page I expected it to come from, pull the values from the querystring, put them in a session variable and then do a redirect back to the same page (removing the querystring values so they can't be viewed by user). This all happens over SSL on the same server.

Can someone point out the security holes of someone intercepting the UserName and Password in this scenario?

Answer 1

If you are using SSL, noone can intercept the request. The problem is actually with the client itself. It's not really a good idea to put username and passwords in a GET request (even encrypted), because:

1. URL can be easily copied and pasted to someone else.
2. If a user clicks an outside link, the URL will be sent as the referrer.
3. XSS attacks can be used to hijack the URL.

Answer 2

Mehrdad already gives some problems, here are some others:

• When used in a get request the username and password will be plainly visible in the users browser's history / cache.
• The username / password combination will probably show up in you server logs too.

Also: think about using 'salted' hashes for the passwords instead of just storing it plaintext (if that's not the case already). Added: As Mehrdad correctly comments: ...even in case of salted hash, it's still vulnerable to replay attacks...

Edit:

@EdenMachine: I think you should google for 'Cross Site Authentication' and the likes - this will be 'somewhat' harder to implement but will (when done correctly) be done more secure (and also seamless). Example link: http://aspalliance.com/1513_Cross_Site_Authentication_and_Data_Transfer.all