Optimistic about your portal-data transmission on the client-insecure http information Header

Optimistic about your portal-data transmission on the client-insecure http information Header
1. In the Internet, a large amount of data is transmitted through URL parameters. Most of the data is not transmitted through encryption. As I have learned, most of the data is carried out in plaintext... Of course, as we all know, the URL parameter is not very secure, so the http information header (including referer and other attributes) has entered our field of view. Referer is used to indicate where the browser is from to the WEB server. 2. Point of View: I don't know when to start. Compared with direct URL parameters, many people think that the HTTP information header has a more powerful anti-expires capability. Many developers trust the value submitted through the cookie and http header, and strictly control the URL parameters. This understanding is not so comprehensive, because all data is exposed to anyone who uses the data interception proxy server. According to the w3.org standard, the http header is completely optional. That is, the Referer attributes can also be changed. 3. Common application scenarios of HTTP information headers, such as a page for modifying user passwords, must be operated by the Administrator. We assume that, if we can determine that this page is from the Administrator, It is trustworthy and operational. For the sake of security, we do not put the authentication information in the URL. We put it in the HTTP information, it looks very high. 4. Simple source code http_accept.jsp for authentication information through the http Header

<% @ Page language = "java" import = "java. util. *, javax. servlet. http. *" pageEncoding = "UTF-8" %> <! Doctype html public "-// W3C // dtd html 4.01 Transitional // EN"> 
 
If it is not from the Super administrator, then I cannot be accessed (the super administrator is from a page called admin. jsp, Which is referer in the http header) <br>
Address: <% = (String) request. getRemoteAddr () %> <br> encoding: <% = (String) request. getCharacterEncoding () %> <br> <% // response. setHeader ("referer", "admin. jsp "); Enumeration <String> reqHeadInfos = request. getHeaderNames (); int I = 0; while (reqHeadInfos. hasMoreElements () {String headName = (String) reqHeadInfos. nextElement (); String headValue = request. getHeader (headName); // get the value of the corresponding request header out based on the name of the request header. write (headName + ":" + headValue); out. write ("<br/>"); if (headName. equals ("referer") & (headValue. equals ("admin. jsp ") {I = 1; // login successful} out. write ("<br/>"); out. write ("
Result: if it is not from the Super administrator, I cannot be accessed (the super administrator is from an admin. jsp page, referer in the http header) Address: 127.0.0.1 encoding: null host: 127.0.0.1: 8080 connection: keep-aliveaccept: text/html, application/xhtml + xml, application/xml; q = 0.9, image/webp, */*; q = 0.8user-agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) chrome/34.0.1847.20.safari/537.36accept-encoding: gzip, deflate, sdchaccept-language: zh-CN, zh; q = 0.8 cookie: JSESSIO NID = 2B927E8B22425D29CB623BD35970CF08 is not an administrator. Please go to the Administrator page because I directly access the link, so there is no referer attribute, and it seems to be quite good. I also wrote a simple code verification code: http_visit.jsp
<% @ Page language = "java" import = "java. util. *, javax. servlet. http. *" pageEncoding = "UTF-8" %> <! Doctype html public "-// W3C // dtd html 4.01 Transitional // EN"> Display: if it is not from the Super administrator, then I cannot be accessed (the super administrator is from an admin. jsp page, referer in the http header) Address: 127.0.0.1 encoding: null host: 127.0.0.1: 8080 connection: keep-aliveaccept: text/html, application/xhtml + xml, application/xml; q = 0.9, image/webp, */*; q = 0.8user-agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) chrome/34.0.1847.w.safari/537.36 referer: http: // 127.0.0.1: 8080/webStudy/http_visit.jspaccept-encoding: gzip, def Late, sdchaccept-language: zh-CN, zh; q = 0.8 cookie: JSESSIONID = 703D6301DAC606173E0118D0DD35BEA1 is not an administrator. Go to the Administrator page. The link we just visited is very good. The test was successful. Like. 5. Although the attacked http header is not displayed on the screen, it seems that the user cannot modify it. However, all the final operations on the client are user-controlled and can be accessed directly by intercepting the proxy server to modify the data.