Website Security

Website Security ISYS 512

Authentication • Authentication is the process that determines the identity of a user.

Forms Authentication • Use username and password to authenticate user. • Once the Forms authentication is enabled, pages cannot be accessed unless the user has the proper authentication. Without authentication, user is redirected to a login page. • If authenticated, an Authentication Ticket is issued in the form of a cookie and user is redirected back to the requested page.

Forms Authentication Ticket • After verifying the submitted credentials, a forms authentication ticket is created for the user. This ticket indicates that the user has been authenticated and includes identifying information, such as the username. The forms authentication ticket is stored as a cookie on the client computer. Therefore, subsequent visits to the website include the forms authentication ticket in the HTTP request, thereby enabling the web application to identify the user once they have logged in.

Forms Authentication Flow Yes, write Authentication Ticket as cookie User No, redirect to No, redirect to Authenticated? Login Page Authenticated? Yes Yes Website

Enabling Forms Authentication • Set the authentication mode for the application by modifying the authentication section in the application root web.config file: <authentication mode="Forms"> • Deny access to anonymous users by modifying the authentication section in the web.config file: <authorization> <deny users="?" /> </authorization> • Create a login page that enables users to enter their usernames and passwords. • If authenticated, an authorization ticket is issued in the form of a cookie.

Example of Web.configure File <configuration> <system.web> <authorization> <deny users="?"/> </authorization> <authentication mode="Forms"> <forms loginUrl="Login.aspx" /> </authentication> </system.web> </configuration>

FormsAuthentication Class • Import system.web.security namespace. • Methods: • RedirectFromLoginPage(String, boolean) • Redirect user back to the page that sent the user to the login page, and write a cookie named .ASPXAUTH containing an Authentication Ticket. • SignOut • Removes the forms-authentication ticket from the browser. • RedirectToLoginPage() • Redirects the browser to the login URL.

Login Control • Login/Login • Properties: • UserName • Password • Event: • Login1_Authenticate

Must Turn Off UnobtrusiveValidationMode:Not Using jQuery protected void Page_Load(object sender, EventArgs e) { Page.UnobtrusiveValidationMode = System.Web.UI.UnobtrusiveValidationMode.None; }

Code Example: User name and password are stored in a database table protected void Login1_Authenticate(object sender, AuthenticateEventArgs e) { string strConn = "Provider=Microsoft.ACE.OLEDB.12.0;Data Source=C:\\CSharpexamples\\SalesDB2011.accdb"; OleDbConnection objConn = new OleDbConnection(strConn); String strSQL = "select * from users where userID='" + Login1.UserName + "'"; OleDbCommand objComm = new OleDbCommand(strSQL, objConn); objConn.Open(); OleDbDataReader myReader; myReader = objComm.ExecuteReader(); if (myReader.Read()) { if (Login1.Password == myReader["Password"].ToString()) FormsAuthentication.RedirectFromLoginPage(Login1.UserName, true); else Response.Write("Invalid password, Access denied"); } else Response.Write("User not exist"); objConn.Close(); }

SignOut Demo • using System.Web.Security; • A signOut page with a button to SignOut; Then redirect to the home page and trigger the authentication again. protected void Button1_Click(object sender, EventArgs e) { FormsAuthentication.SignOut(); FormsAuthentication.RedirectToLoginPage(); }

SQL Injection Demo • On a web page that takes customer ID entered in a textbox as input, then displays the customer’s data. • 1. Retrieve all records:In the textbox, enter: ‘ OR 1=1 OR CID = ‘ 2. Guess table name or field name: ‘ AND 1=(SELECT COUNT(*) FROM Orders) AND CID=‘ 3. Finding some users: ' or cname like 'S%' or cid=‘

Demo protected void Button1_Click(object sender, EventArgs e) { string strConn = "Provider=Microsoft.ACE.OLEDB.12.0;Data Source=C:\\CSharpexamples\\SalesDB2011.accdb"; OleDbConnection objConn = new OleDbConnection(strConn); String strSQL = "select * from customer where cid='" + TextBox1.Text + "'"; OleDbCommand objComm = new OleDbCommand(strSQL, objConn); objConn.Open(); OleDbDataReader myReader; myReader = objComm.ExecuteReader(); if (myReader.HasRows) { GridView1.DataSource = myReader; GridView1.DataBind(); } else Response.Write("User not exist"); objConn.Close(); }

Validation Controls: May need to turn off JQuery • RequiredFieldValidator: • Control to Validate • RangeValidator: • MaximumValue, MinimumValue • CompareValidator: • Control to Validate, Control to compare • Operator such as equal, less than, etc. • RegularExpressionValidator: • ValidationExpression • CustomValidator: • ClientValidationFunction;

What is Regular Expression? • Regular expression is a language designed to manipulate text. Users use its extensive pattern-matching notations to write regular expressions to: • Search text; • Extract, edit, replace, or delete text substrings; • Validate input data: • values, formats • Examples: • *.doc • Select * From Student Where Sname = ‘C%’;

Examples of Regular Expressions • Allowable values: • San Francisco|Los Angeles|Taipei • A|B|C • AlphaNumeric • [a-zA-Z0-9]+ • EmpID begins with E followed by 3 digits: • E\d{3} • String length: • Exactly 3 characters: ^.{3}$

FileUpload Control • Properties: • PostedFile: • This is a System.Web.HttpPostedFile class • FileName: This name contains the path of the posted file.’ • Contentlength • ContentType • Method: • SaveAs – this method save the posted file on server.

Save Uploaded File protected void Button1_Click(object sender, EventArgs e) { string FileName; string strFilePath= "C:\\CSharpExamples\\testASP\\testASP\\Images\\"; FileName = FileUpload1.PostedFile.FileName.Substring(FileUpload1.PostedFile.FileName.LastIndexOf("\\") + 1); strFilePath = strFilePath + FileName; FileUpload1.SaveAs(strFilePath); Response.Write("File: " + FileName + " is saved on server"); }

Example of Processing Pictures • SalesDB database PictureTale: • Picture file name: • Relative reference • Absolute reference • Creating links to picture files • Insert pictures in web page • IMG tag example: <img border="0" src="/images/pulpit.jpg" alt="Pulpit rock" width="304" height="228">

This example assumes photos are stored in Images folder protected void Page_Load(object sender, EventArgs e) { Response.Write("Available Pictures"); string strConn = "Provider=Microsoft.ACE.OLEDB.12.0;Data Source=C:\\CSharpexamples\\SalesDB2011.accdb"; OleDbConnection objConn = new OleDbConnection(strConn); string strSQL = "select PicID, PicDescription, PicPath from PictureTable;"; OleDbCommand objComm = new OleDbCommand(strSQL, objConn); objConn.Open(); OleDbDataReader objDataReader; objDataReader = objComm.ExecuteReader(); while (objDataReader.Read()) { Response.Write("<img border='0' src='Images/" + objDataReader["PicPath"] + "' width='198' height='151'>"); } objConn.Close(); }

Insurance Claim Example • Uploading claim pictures for insurance cases. • Each case may have many pictures. • Database: • CaseTable: CaseID, CaseDate, Agent • CasePics: CaseID, PicPathName • Each picture is named: CaseID + PictureName and saved in folder: Images • Create a web page with a dropdown list of CaseID, a File Field control to choose file, and a upload button. The uploaded picture will be saved in the Images folder and a record will be entered in CasePics file.

Website Security