Verify the Session verification code and avoid bypassing the verification code attack.

Source: Internet
Author: User

You can't remember the website on which the verification code is displayed. Generally, you can easily write the Verification Code as follows: Copy codeThe Code is as follows: <%
If Request. Form ("SecurityCode") = Session ("SecurityCode") Then
'Todo: Database operations
Else
Response. Write "Security code incorrect! "
End If
%>

The verification code image generates the Session ("SecurityCode"), saves the correct verification code value, and obtains the verification code value submitted by the user. If the two verification codes are the same, the verification code is correct. Otherwise, the verification code is incorrect. On the surface, there is no problem with such an algorithm, but in a special case, the verification code will be virtually empty.
First, we know that the core of the above algorithm is that we need to access the file that generates the verification code image to have a Session that saves the verification code value, then, the user's input can be correctly compared. If someone is interested in constructing a Form that bypasses the verification code image file and then submitting it, what will get? The Session ("SecurityCode") does not exist. If no verification code is entered at this time, the verification code is virtually empty. Well, the key to exploiting the vulnerability attack here is the verification code Session. We can easily prevent the server from generating this Session to make this attack possible.
The solution is also easy. Check whether the verification code Session is empty or whether the verification code entered by the user is valid. The key to constructing a security form is never to trust the user input. The following uses the verification code Session and the double insurance method entered by the user to solve this security problem:Copy codeThe Code is as follows: 'str is the verification code to be verified, and len is the verification code length.
Function IsSecurityCodeValid (str, len)
IsSecurityCodeValid = Not CBool (_
IsEmpty (str) Or CStr (str) = "" Or Len (str) <len)
End Function
If IsSecurityCodeValid (Request. Form ("SecurityCode"), 4) AND _
IsSecurityCodeValid (Session ("SecurityCode"), 4) AND _
Request. Form ("SecurityCode") = Session ("SecurityCode") Then
'Todo: Database operations
Else
Response. Write "Security code incorrect! "
End If

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.