Preventing cross-site scripting

Customer Support Customer Only Discussion
1

[SIZE=“1”]Note: I’ve posted this here, rather than in the coding forum due to the sensitive nature of the subject.[/SIZE]

OK, so we use regular expressions, strong encryption, server.htmlencode, stored procedures and no client-side scripting in all of our applications, so AFAIK have done everything possible to prevent this kind of attack, but it still bothers me that one can post forms from one domain to another and have the contents processed.

Is there any way, using asp/php to simply find out what domain the form is coming from and either redirect/deny or accept if it comes from any domain other than the one it’s supposed to come from?

2

In PHP, you could use something like:

[PHP]if(strpos($_SERVER[‘HTTP_REFERER’], $_SERVER[‘HTTP_HOST’]) === FALSE) {
header(‘Location:http://www. yourserver .com’);
die();
}[/PHP]

In this case, you would have a page on your site linking to your form page, so HTTP_REFERER should contain your site’s URL. Thus, it should match HTTP_HOST. This wouldn’t work if you expect folks to load your form from a bookmark/favorite or via a link from another site.

I use the above with tell-a-friend and contact-us type forms. In such cases, I certainly do want to limit access to my form page to clicks from my own site.

Of course, this could be hacked because a bot could fake the referer. But I expect that few would do so because there are so many other poorly protected sites that could be used without special intervention.

Tim

3

Right, Request.ServerVariables(“HTTP_REFERER”) = Request.ServerVariables(“SERVER_NAME”) in asp would do the same.

Given that a bot can fake the referer, I wonder if it’s worth the effort to put this in or if it’s just too transparent to be worthwhile.