textbook review 4.docx

3 Pages
Unlock Document

George Brown College
Computer programming
Comp 2098
Tom Yeung

The first step in securing your applications is deciding where you need security and what it needs to protect. For example, you may need to block access in order to protect private information. Or, maybe you just need to enforce a pay-for-content system. Perhaps you don’t need any sort of security at all, but you want an optional login feature to provide personalization for frequent visitors. These requirements will determine the approach you use. Security doesn’t need to be complex, but it does need to be wide-ranging and multilayered. For example, consider an e-commerce website that allows users to view reports of their recently placed orders. You probably already know the first line of defense that this website should use—a login page that forces users to identify themselves before they can see any personal information. In this chapter, you’ll learn how to use this sort of authentication system. However, it’s important to realize that, on its own, this layer of protection is not enough to truly secure your system. You also need to protect the back-end database with a strong password, and you might even choose to encrypt sensitive information before you store it (scrambling so that it’s unreadable without the right key to decrypt it). Steps like these protect your website from other attacks that get beyond your authentication system. For example, they can deter a disgruntled employee with an account on the local network, a hacker who has gained access to your network through the company firewall, or a careless technician who discards a hard drive used for data storage without erasing it first. Furthermore, you’ll need to hunt carefully for weaknesses in the code you’ve written. A surprising number of websites fall prey to relatively simple attacks in which a malicious user simply tampers with a query string argument or a bit of HTML in the rendered page. In the e-commerce example, you need to make sure that a user who successfully logs in can’t view another user’s recent orders. Imagine you’ve created a ViewOrders.aspx page that takes a query string argument named userID, like this: http://localhost/InsecureStore/ViewOrders.aspx?userID=4191 This example is a security nightmare, because any user can easily modify the userID parameter by editing the URL to see another user’s information. A better solution would be to design the ViewOrders.aspx page so that it gets the user ID from the currently logged-on user identity (a trick you’ll learn in this chapter) and then uses that to construct the right database command. Two concepts form the basis of any discussion about security: Aut
More Less

Related notes for Comp 2098

Log In


Don't have an account?

Join OneClass

Access over 10 million pages of study
documents for 1.3 million courses.

Sign up

Join to view


By registering, I agree to the Terms and Privacy Policies
Already have an account?
Just a few more details

So we can recommend you notes for your school.

Reset Password

Please enter below the email address you registered with and we will send you a link to reset your password.

Add your courses

Get notes from the top students in your class.