"Java" System vulnerability: Considerations for post-logon actions for users

Project background:

SPRINGMVC + Mybatis + MySQL Database (Javaweb project development)

Related modules: Login, personal details modification, Order Details inquiry

Related Vulnerability Description :

　　1. Login Verification Code: Login Verification Code must be in the background to do the verification, if only the foreground verification verification Code, the background is not verified, the first verification code may occur, through the tool to bypass the verification code for brute force cracking;

　　2. Interceptor: to the login after the interface name such as the operation of personal information to use/USER or/admin interception, such as the user is not logged in, will automatically jump to the login page;

　　3. Personal details of the modification: the user's information to be stored in the session, such as the user's ID, such as personal information modification, if it is a secret interface (that is, the modification of information does not require a password), modify the account information, you must not directly pass the user's ID to do a unique identity, When using the user's critical information, it is possible to obtain the current logged-in user's information from the session and prevent the user's personal information from being modified after the account is logged in as 3000001.

　　4. Order Details Interface: If it is to query the user's order details, only through the order ID query, even if the interface name plus/user, interception of users who are not logged in, it is possible that other users can log in to find the details of non-personal orders. In this case, be sure to check the order details before verifying that the order is the current user's personal orders, that is, verify the ID in the session with the creator of the Order of the ID of the same, to prevent the disclosure of information;

(Note: The above loopholes really happened, sent to hope that the other new warning, but also hope to communicate with more people in the development of the problems encountered)

"Java" System vulnerability: Considerations for post-logon actions for users