SECURITY Flaws in this design for User authentication.

Posted by Shao on Stack Overflow See other posts from Stack Overflow or by Shao
Published on 2010-04-02T16:48:12Z Indexed on 2010/04/02 16:53 UTC
Read the original article Hit count: 419

Filed under:

pylons

|

authentication

SECURITY Flaws in this design for User authentication.

From: http://wiki.pylonshq.com/display/pylonscookbook/Simple+Homegrown+Authentication

Note: a. Project follows the MVC pattern. b. Only a user with a valid username and password is allowed submit something.

Design: a. Have a base controller from which all controllers are derived from. b. Before any of the actions in the derived controllers are called the system calls a before action in the base controller. c. In each controller user hardcodes the actions that need to be verified in an array. d. The before action first looks in the array that has the actions that are protected and sees if a user is logged in or not by peaking into the session. If a user is present then user is allowed to submit otherwise user is redirected to login page.

What do you think?

© Stack Overflow or respective owner

Related posts about pylons

Logging in worker threads spawned from a pylons application does not seem to work

as seen on Stack Overflow - Search for 'Stack Overflow'
I have a pylons application where, under certain cirumstances I want to spawn multiple worker threads to process items in a queue. Right now we aren't making use of a ThreadPool (would be ideal, but we'll add that in later). The main problem is that the worker threads logging does not get written… >>> More
Pylons FormEncode @validate decorator pass parameters into re-render action

as seen on Stack Overflow - Search for 'Stack Overflow'
I am attempting to use the validate decorator in Pylons with FormEncode and I have encountered an issue. I am attempting to validate a form on a controller action that requires parameters, and if the validation fails, the parameters aren't passed back in when the form is re-rendered. Here's an example… >>> More
How to set cookies with redirect in Pylons

as seen on Stack Overflow - Search for 'Stack Overflow'
In light of the cookie-handling bugs affecting Safari and Chrome (see this thread), and Pylons implementation of redirect_to as an exception, is it possible to reliably set a tracking cookie and redirect at the same time? Is the META refresh method looked down upon? >>> More
Disable browser caching in pylons

as seen on Stack Overflow - Search for 'Stack Overflow'
I'm have an action /json that returns json from the server. Unfortunately in IE, the browser likes to cache this json. How can I make it so that this action doesn't cache? >>> More
Deploying Pylons with Nginx reverse proxy?

as seen on Stack Overflow - Search for 'Stack Overflow'
Is there a tutorial on how to deploy Pylons with Nginx? I've been able to start nginx and then serve pylons to :8080 with paster serve development.ini However, I can't seem to do other stuff as pylons locks me into that serve mode. If I try to CTRL+Z out of pylons serving to do other stuff on my… >>> More

Related posts about authentication

Configuring Fed Authentication Methods in OIF / IdP

as seen on Oracle Blogs - Search for 'Oracle Blogs'
In this article, I will provide examples on how to configure OIF/IdP to map OAM Authentication Schemes to Federation Authentication Methods, based on the concepts introduced in my previous entry. I will show examples for the three protocols supported by OIF: SAML 2.0 SSO SAML… >>> More
windows authentication vs sql server authentication for asp.net forms authentication site

as seen on Stack Overflow - Search for 'Stack Overflow'
I have a database and a site having forms authentication. It is working fine with VS2008. This time, I am using "Trusted_connection =True". But when it is opened from outside or directly from browser then I am getting error "Login failed for user 'NT AUTHORITY\ANONYMOUS LOGON'." I know this is due… >>> More
Disable authentication on subfolder(s) of an ASP.NET app using windows authentication

as seen on Stack Overflow - Search for 'Stack Overflow'
Hi, Is it possible to disable windows authentication on one or more subfolders of an ASP.net application using windows authentication? >>> More
AutoCompleteExtender - authentication failure (forms authentication)

as seen on Stack Overflow - Search for 'Stack Overflow'
I'm using the AutoCompleteExtender from the AJAX control toolkit on my aspx page - I have it wired up to a WCF service that is returning a string array and everything works happily. If I change my service definition to include a demand for the caller to be authenticated, like so: <OperationContract()… >>> More
Ruby on Rails , functionalities having twitter authentication and email authentication (autlogic and

as seen on Stack Overflow - Search for 'Stack Overflow'
Hi Experts, I would like to ask your guidance on how to authenticate using email add/ the basic log-in while having also a twitter log-in, twitter authentication works fine but if having an alternative log-in like using basic sign-up and email log-in part wont work.... any ideas please...? >>> More