1

I am very new in web api security. I have used form authentication technique. when user logs in, a token is created and stored as a cookie in user's web browser. On each request the token is varified and if user is authenticated and authorized user is given access to the service.

but I think this approach does nothing in web api security. cookies can easily be copied and pasted in other browser and anyone can get the service.

I am thinking to use App key and secret along with form authentication. I am not suggested to use third party service like Oauth for authentication. I am not Sure about the Implementation of app key and secret that how it exactly works.

Please provide better way to secure my web api wihtout using third party services and to prevent cookie hijacking etc. What actions are performed to build a strengthly secure web api.

vivek
  • 79
  • 2
  • 11
  • _"cookies can easily be copied and pasted in other browser and anyone can get the service."_ - this does require a logged in account though. – CodeCaster Oct 15 '13 at 08:46
  • How will you know that the authentication cookies are coming from logged in account. user has access of services if he has authentication token which is stored in cookie. if any other user copies the the cookie and token is not expired, he will also be authenticated. – vivek Oct 15 '13 at 08:52
  • And if I copy your Facebook cookie I can stalk your friends. See [Forms Authentication Cookie value vulnerability](http://stackoverflow.com/questions/11208793/forms-authentication-cookie-value-vulnerability-in-asp-net) for example for a discussion on that topic. – CodeCaster Oct 15 '13 at 08:56
  • @vivek please check my answer below. Your worries are valid. But check your authentication cookie and make sure it is httpOnly, and I would not give the user ability to stay logged (don't store cookies). You might also choose a short idle time out if you are so worried. – A Khudairy Oct 15 '13 at 15:43

1 Answers1

0

The forms authentication is good enough. You can also do the following:

  1. Use anti-forgery (antifrogery) tokens. Check this or this
  2. It will also be great if on sensitive actions you check if the call to the function was made from the same site or not.You can implement your own action filter for this. (check if the referral site is your site, or the expected site)

Edited:

Thanks guys for your comments. I guess you are right. Well authentication cookies in ASP are created as httpOnly cookies which means even if the site had some XSS vulnerabilities it will still be safe and cant be stolen. I would also suggest to use https everywhere if the site is used for sensitive operations (like a bank) to make sure the cookies are perfectly safe.

Community
  • 1
  • 1
A Khudairy
  • 1,422
  • 1
  • 15
  • 26