3

I have multiple forms and use AJAX to submit them. I asked my boss if he needed any specific format for the form ID and he told me to generate a unique hash and keep it in session; check it whenever the form comes back to make sure it's a valid form submission and not someone just hitting an endpoint.

What does that mean and why is it useful? How does it help me security wise?

I have read a couple of articles like The 3 things you should know about hashCode() but I'm still not sure...

10
  • that article is about the hashCode method in java to provide correct behavior in the hash based sets Jul 15, 2015 at 15:27
  • @ratchetfreak that is just for understanding, i want to know how it will be useful ?
    – nikunjM
    Jul 15, 2015 at 15:30
  • That article is unrelated to what your boss wants, he wants you to implement a session key of sorts. Jul 15, 2015 at 15:32
  • 2
    Try This SO question's answers for some insight. You only need a special has that you can compare against one created during authentication so you know subsequent requests are from that user (or really, are not from anyone else)
    – gbjbaanb
    Jul 15, 2015 at 15:32
  • @gbjbaanb not uncommon to have a 'latest' for the session that is computed from the previous one to avoid a replay attack. Each step, the token is regenerated. Doesn't work for stateless requests though.
    – user40980
    Jul 15, 2015 at 15:42

2 Answers 2

4

The technique your boss has told you to use is one of the common ways of preventing cross site request forgery. I think you're probably getting confused by the multiple meanings of "hash" which in this case probably refers to a secure hash (eg SHA256) rather than a hash that you might use for a hash table.

0

Why should I do it?

So we create a form, and we'll have an endpoint where that data can get submitted.

Which means anyone can submit data there and see what happens.

So we need to validate on two things:

  1. that it's being submitted by a user (which .NET will handle for us), and
  2. that they're submitting data via a requested form and not just willy-nilly

So the submit button needs a validation hash that gets passed back with the form, then we compare that to the value we stored in the user's session (on the server) when we created the form.

If they match, we process the data, otherwise we throw an error.

Way to do it:

Write a function which converts genrated id and creates hash for it.

Get the form, decrypt the hash to get the original ID, compare them with the id stored in session, and voila.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.