Web application security issue after using QueryString and AJAX get

Question

I have written the following code for a room booking web application. However, as I am really new at this, I can't quite comprehend whether the code is "safe" or not.

So my questions is this: After I receive parameters from QueryString, could the following code be manipulated by a user, in for instance Google Chrome's Inspect Element, into a state where a student has uses someone else's credentials?

Please assume that I will receive the QueryString encrypted, and I'm assuming that I can decrypt it in the controller before loading up the view.

The view:

<script>
    var scheduler = $("#scheduler4").data("kendoScheduler");

    /* Get QueryString and search for student in external URL */
    $(document).ready(function () {

        var url = document.URL;

        var nameIndex = url.indexOf("name=");
        var name;

        var emailIndex = url.indexOf("email=");
        var email;


        if (emailIndex > -1 && staffIndex == -1) {

            name = url.substr((nameIndex + 5), emailIndex - (nameIndex + 5 + 1));

            email = url.substr((emailIndex + 6));
            email = email.substr(0, (email.length - 4)) + "@@email.com";

            /* Check student directory to see if this email exists */
            var url = '@Url.Action("CheckStudentDirectory", "Home")';
            // alert(email);
            var data = { name: name, email: email };

            $(".loading-overlay").show();
            $.get(url, data)
                .done(function (response, status, jqxhr) {

                        if (response.exists === true) {

                            $.ajax({
                                type: 'GET',
                                url: '@Url.Action("StudentScheduler", "Home")',
                                success: function (data) {
                                    $('#incomingscheduler').html(data);
                                    }
                                });
                        }
                .fail(function (jqxhr, status, errorThrown) {

                        /* problem with XML file at CheckDirectory */
                        alert("Something went wrong with authentication");
                .complete(function () {
                    $(".loading-overlay").hide();
                    });
                }
            });
</script>

<body>

    <!-- Scheduler-->
    <div id="incomingscheduler">
        <!-- Schedulers will be loaded in here -->
    </div>

</body>

score 0 · Answer 1 · answered Oct 08 '15 at 17:59

do this at controller level.. like "

public ActionResult Test(string email,string name)
{
     //do your stuff
}

This action automatically take name and email from your query string but the query string parameter name and argument name of action should be same.

score 0 · Accepted Answer · edited May 23 '17 at 12:14

0

could the following code be manipulated by a user... into a state where a student has uses someone else's credentials?

Yes -- Any parameters sent to your application, via query string or form post, can be manipulated by a user. Encryption isn't protecting you from unauthorized access.

Always validate user input on the server. You need to verify on the server that an authenticated user really owns the name and email or any other sensitive resource.

Furthermore, encrypted query strings may still be logged in plain text.

edited May 23 '17 at 12:14

Community

1
1

answered Oct 08 '15 at 18:34

Jasen

14,030
3
51
68

Could I do the following? (1) Receive encrypted querystring (2) Go to controller with it via AJAX call to decrypt (3) Save the email and name of the user in the controller (4) return back to view (5) during a new booking creation, check the email and name on server side. – Uğur Dinç Oct 08 '15 at 21:11
Suppose a user copied the encrypted querystring for another user. How do you know it is legitimate? – Jasen Oct 08 '15 at 21:58
I wouldn't be able to know it, but from what it seems, the IT department doesn't want to create a Windows Service for me to make the proper authentication. In other words, this is a risk they are willing to take. In the very end though, I am thinking that if I were to create querystrings that expire at the end of everyday, then it could add into the safety of the situation. – Uğur Dinç Oct 08 '15 at 22:10

Web application security issue after using QueryString and AJAX get

2 Answers2