Preventing Hacking of Javascript

[drkestrel]

Javascript validation functions in pages generated from ASP could be 'by-passed' by user by saving the ASP page and removing the Javascript validation and then submitting from form.

I would like to prevent that happening (possibly ) by examing the Request object. But I don't have any luck with figuring out whether the request came from

http://www.myserver.com

or c:\hackedpage.html

I tried looking at
The following always return the server's host name
Request.ServerVariables("SERVER_NAME&quot

The following always return the path on server
Request.ServerVariables("SCRIPT_NAME&quot
Request.ServerVariables("PATH_INFO&quot

The following always return the current ASP's path on server (i.e. c:\inetpub\wwwroot\....)
Request.ServerVariables("PATH_TRANSLATED&quot

The following always return empty string/i]
Request.ServerVariables("QUERY_STRING&quot
Request.ServerVariables("REMOTE_USER&quot
Request.ServerVariables("PATH&quot

Any help would be appreciated.

 

[drkestrel]

i figured out I could use HTTP_REFERRER, but
1) It won't work for the "First" page.
2) That won't be set where Page.Redirect is use in ASP VB Script.

 

[sjuarez1979]

Why not validate on the server side?

 

[drkestrel]

I am checking the HTTP_REFERRER on the IIS Server!!

 

[Deadline]

Hi,
Lets see how this method works out for you.

Instead of using a Submit button (

<INPUT TYPE=SUBMIT>

), try using a plain Button(

<INPUT TYPE=BUTTON>

). Submit the form programmatically with the OnClick event of the button.

Let us know if this technique works.

Thank you...
RR

 

[JohnYingling]

"Why not validate on the server side?" means that client-side vaidation of input is just a convenience for the user. If you trust the data that you get from the client based on "client side" validation then you are playing with fire. Anybody using Web Browser Control or Inet can bypass all your JavaScript "on the fly".

http://www.VBCompare.com

Compare Code (Text)

http://www.VBSortGen.com

Generate Sort in VB or VBScript

 

[sjuarez1979]

I think perhaps I've been misunderstood. The problem you identified was the following:

"Javascript validation functions in pages generated from ASP could be 'by-passed' by user by saving the ASP page and removing the Javascript validation and then submitting from form."

If the problem is the JavaScript, get rid of it and validate the form on the server side using ASP when passing the data from the Web Form to whatever medium you are storing it in. The problem isnt finding out who can hack your page, its eliminating the threat. The over head involved with checking string variables on the server-side is almost insignificant if considering that doing so will eliminate your JavaScript problem and more importantly, the threat of having your Web Application hacked.

sjuarez1979

 

[Deadline]

How about this ?

Set a cookie or a session variable in the previous page(the one with FORM elements), and check if it exists the subsequent page. If it doesn't, that implies it is an invalid submission.

Thank you...
RR