Re: ASP authentication

[Erik Kangas <kangas () luxsci com>]

Bénoni MARTIN wrote:

> Hi List,
>
> I am wondering what was the most secure way to allow users to access pages after authentication, i.e.: user 
> authenticates in toto.asp, and after that, access is granted to tata_1.asp, tata_2.asp, ..., tata_n.asp. The trouble is 
> obviously to ask the user once for his login / password (just in tot.asp), and to allow him to get to the other pages 
> without asking each time his credentials.
>
> Googling around, I saw a couple of ways to meet my needs, but all seem to be weak:
> - I can set a hidden field where I can say "yes, he is authenticated" or "no, he is not", but anyone a little bit 
> skilled can create a fake request having this set up by hand (with a proxy ! ),
> - I can check a session number or smth like that on each page...but this does not seem very reliable,
> - I can check IP adress...but when you use AOL for instance, IP adresses can change !
>
> So none of the ways I found seem to be the best... 
>  
> Cheers list, for any reply / clue !

The is a classic issue that every developer faces.  One of the better ways 
to handle this is the following:

1. Use SSL to encrypt the traffic to begin with.

2. Your login page sets 3 cookies (or hidden form fields)
   - One is a session id
   - One is the time stamp (or epoch seconds) of this page view
   - One is a hash (i.e. MD5) of the session ID, time stamp and their 
password using some random salt.

   - On the back end, keep track of who belongs to each session id.


3. On each successive page, you get these 3 values back and reset them (so 
the time stamp and hash keep being updated).

4. To determine if the person is authenticated, use the session id to look 
up their password in your back end.  Use that and the passed time stamp to 
make a hash comparable to the one passed back to you.

   - If the hashes match, then the credentials have not been tampered with
   - If too much time has elapsed, you may want to automatically log
     them off to mitigate the effect of replay attacks.

Even this mechanism has problems with replay attacks
 - The credentials can be sniffed if you do not use SSL or if there is an
   SSL proxy in the middle you are ignoring.
 - The credentials can be obtained by anyone with access to the user's 
computer.


--

Erik Kangas, Ph.D. --- President of Lux Scientiae, Incorporated

Lux Scientiae:       1-800-441-6612        P.O. Box 326
FAX:                 1-413-332-0598        Westwood, Massachusetts
Cell:                1-617-596-9558        02090, USA
AIM Chat:            Screen Name "luxsci"

kangas () luxsci com  ---  http://luxsci.com