With todays browser extensions/tools is it not easily possible for a user to edit the html/css settings of a website and so enable some disabled buttons etc... to gain access to not permitted areas?
Add a comment
|
3 Answers
Yes it's possible to manipulate anything in the client side, which includes HTML, CSS, and JavaScript. However the original client side code is stored in the server, and while you can manipulate it, if you do not have access to the server you can not save your changes. Refreshing your browser essentially means requesting a fresh copy of the client side code, so all changes to your local copy will vanish.
As for restricted areas, let's say for example a login form. While you can change the colors and/or size of the password input box, the code that validates whether the password is correct resides on the server, you have no access to it, and your client side changes doesn't affect it, so there's nothing to worry about.
-
2Well, the validation should be on the server. What you explain is precisely why those who don't put it there are do it horribly wrong.– user7043May 18, 2012 at 18:16
Assuming that your statement of enabling previously disabled buttons or links through the browser dev tools means that the user then gets access to an area of the application they otherwise wouldn't have, you're referring to what's known as an authorization vulnerability. In this case, the security is reliant on the presentation layer to enforce it, which as you know, is easy to circumvent.
The best defense against this is to perform your authorization in both the presentation layer (browser) and the business layer (server). Always validate and authorize user requests on the server. Doing so in the browser is usually recommended to improve the user experience (i.e., don't show me links to functions I can't do because it's just visual noise to parse through) and it hides functionality that would otherwise be inadvertently communicated. Only show what you have to, but validate and authorize everything on the server.
It depends on what those files contain.
For example, let's say that person A has a website. This website has a link (or button or whatever) to some web page which should only be available to administrators, with stuff used in debugging (like clearing the database for example). When he the site goes live, he decides that instead of removing the link and the debugging code, he only comments out the link and leaves in the debugging stuff. Boom! You can imagine that anyone can see the comment by viewing the source of the page in any browser.
But then again, this type of things only happen because of human error (and maybe stupidity). I for one haven't seen this stuff ever in my life and would be amazed if I ever did.
If you build a website right and don`t leave any nasty stuff in your code then you are all fine.
When you visit a website you only get files which describe what you see on the screen. As for the functionality (scripting) part, these come in two different flavors. First there is the client side scripting and unless you want to harm yourself, there's not much you can do with it. Second, there is the server side scripting which does contain code for connecting to the database and retrieving information and such, but you NEVER receive it (secrets :P).
In the end, there are possibilities for bod things to happen from html and css but you really, really, really have to go out of your to enable them.
