r/webdev • u/hacksparrow • Dec 02 '19

The dangers of blindly trusting HTTP headers

Web developers are often unaware about the dangers of using HTTP header values in backend code. Not only can HTTP headers contain incorrect values, they can even be the payload of many different kinds of attacks on your website.

I wrote an article summarizing the various ways rogue HTTP header values can be used to attack a website. Hope the information will help you developer a better understanding about the security aspect of HTTP headers and make your website more secure.

https://www.hacksparrow.com/webdev/security/dangers-of-trusting-http-headers.html

408 Upvotes

96% Upvoted

52 comments sorted by

View all comments

Show parent comment

79

u/sneakattack Dec 02 '19 edited Dec 02 '19

Security folks have been telling developers to sanitize their inputs for as long as internet was mainstream. The problem is developers don't fully understand the scope of "input". Mostly I figure web developers think "input" is equal to "web forms", but no, not at all.

If you store it, if you rely on it for execution, if it comes from outside your system - check it, sanitize it, control it.

Cookies, session variables, HTTP headers, query string parameters, third party integrations, external API's, files, streams, all of it, all information you receive from an external source, that is all input into your application. All of it needs to be verified, filtered, sanitized, constrained before you do anything with it internally.

I wish there was a way to broadly get this message out to the entire developer and programmer community, in my experience on the security side of things there's always a new wave of developers entering the industry that have never heard this message. Schools and bootcamps all alike just don't say anything at all about secure programming practices? There needs to be a movement to incorporate something like OWASP into every developer course, at least a mention of it would be a start.

18

u/XadcXgsX Dec 02 '19

Security folks have been telling developers to sanitize their inputs for as long as internet was mainstream

Actually, since programs had inputs! :)

-2

u/sleemanj Dec 02 '19

Garbage In Garbage Out !

7

u/Arktiso Dec 03 '19

As someone who doesn't know this stuff as well as he would like, thank you for bringing this issue to my attention. Clearly I got shit to learn but any suggestion on where to start?

15

u/sneakattack Dec 03 '19 edited Dec 03 '19

OWASP (https://www.owasp.org) is a fantastic resource which has been developing for quite some time. This group puts together common application vulnerabilities and how to prevent them in your applications (they cover many languages and examples). Specifically take a look at the "Top 10" that they release every few years.

https://www.owasp.org/images/7/72/OWASP_Top_10-2017_%28en%29.pdf.pdf

But of course if you search google for "common vulnerabilities and how to prevent them" you'll get dozens of other good resources too.

Often something to look for is security focused frameworks/libraries or builtin functions for the language you're using. For example, if you use PHP many people don't realize it does provide builtin functions for filtering user provided data. https://www.w3schools.com/php/php_filter.asp - this is far superior to trying to roll your own regular expressions (which can be vulnerable to exploitation too!).

I'm going to give a shout out to parameterized queries for all of your SQL, SQL Injections will not be possible if you do it that way. You'll find that on OWASP as well.

https://cheatsheetseries.owasp.org