0

Before asking the question, I admit that this method is uberly discouraged and not secure. I am aware that to achieve this is through SSL.

However, I am developing an HTML5 apps (and it seems that implementing the SSL approach would take a lot of time) and I would like to know the best way to POST a form content.

i.e I have the following form

<form id="someform" name="someform" method="POST" action="some/server/url">

The way this form is submitted (currently) is using ajax $("#someform).serialize() and so on..

Using this implementation I am facing with (at least) these 2 immediate problems:

  1. User could use tools (i.e TamperData | a firefox addons) to modify the posted content (Interception-and-modify).
  2. User could forge the data by sending 'fake'submission (Forging)

I am wondering if there is somehow I could at least (obfuscate the POST-ed) value.

I came across with this great http://www.jcryption.org/ tools, but not sure how should I implement it to workaround the problem I am facing.

ps: again I am aware that relying on client-side script is way less secure compared with handling all execution from within the server-side.

framework + language I am using is: CodeIgniter + PHP + JavaScript (jquery)

1st Amendment:

I am sure there is at least a work around using this theory

First, I am not too worried about the confidentiality part of my data, that is the POST-ed value will not give any valuable information even if someone else knows what it is.

What concerns me though is the integrity and the authenticity of the POST-ed value. This is simply means that no one else should tamper the information once its being transmitted (once the submit button is clicked), nor anyone could forge or create a fake value (spoofing the server).

This theory leads to digital signature, where (again in theory) I should somehow sign the POST-ed value using server PUB-key, then hash the POST-ed value using the server PUB-key and finally send both the original POST-ed value along with the hashed value.

Prior sending the POST-ed value, the client MUST request for the server PUB-key, so the client can hash the POST-ed value. The server could probably store the PUB-key information along with SESSION information.

Then the server will have to (again) hash (this time with the server PRI-key) the original POST-ed value (sent by client) and compare the two hashed value. If those value is the same, it simply means it is authentic.

Now the part which I am yet to understand is the HOW.....

is there any tools/frameworks/plugins/tutorial/example on how to do this? since it would be too much for me (not to mention the limited amount of time I have) for developing the whole Public-Key-Infrastructure from scratch

Improve this question

2 Answers 2

Reset to default
3

Take one step further and realize that a user can encrypt faked data as well.
And SSL won't help against such a tampering.

That's a web-development axiom: everything can be faked on the client side. Period.

So, instead of encrypting anything, just verify your input on the server side, like every other site does.

Use sessions to store the data that a user should have no access to.

Improve this answer
Sign up to request clarification or add additional context in comments.

4 Comments

@Your_Common_Sense, even with session, "authenticated" user can fake the data. Also, how should i verify my input?
No, they can't tamper on a session data. That's the very point of the mechanism, as session data stored on the server side. Verify your input usual way.
If i have to be brutally honest with you, i am still not sure if i can follow your suggestion. How could i verify the user input (looking from the technical perspective)?
Just do not expect valid data from the client and validate it manually. that's all. I don't understand your misunderstanding in turn - input data validation is a cornerstone of web-programming, every site in the world does it. To validate input is ALL that a server can do against tampering.
-1

User

Spoofed Form Submissions

You will get full info here

Improve this answer

1 Comment

Don;t know why. Please dare to comment , if you dare to downvote

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.