Varun Sharma from Microsoft India identifies 5 common authentication and authorization flaws in web applications: 1. Custom authentication is implemented instead of using proven system methods. 2. Rule-based authorization is not considered, with authorization relying only on disabling UI elements. 3. Input validation only checks for blacklisted characters instead of whitelisting allowed values. 4. Cryptography is improperly implemented without understanding what security mechanisms provide. 5. Applications are vulnerable to denial of service attacks from excessive automated requests.

1. Varun Sharma Application Consulting and Engineering (ACE) Team, Microsoft India

2. Flaw – 1 Custom Authentication Flaw – 2 Lack of Rule based Authorization Flaw – 3 Black list input validation Flaw – 4 Improper use of Crypto Flaw – 5 App layer DOS attack

3. Site implements custom forms authentication Buggy code Demo

4. Principles:- Use well known and time tested, system provided methods for authentication. Avoid writing custom authentication code.

5. Authorization implemented by disabling UI Rule based authorization not considered Demo

6. Principles:- Do not rely on UI for authorization Disabled buttons is not authorization Consider rule based authorization in your design

7. Only set of bad characters are checked for Becomes vulnerable in special situations Demo

8. Principles:- Validate for valid allowed values (white list) If white list validation is not possible, Encode to prevent XSS Parameterize to prevent SQL Injection…

9. Not knowing what services are provided by what mechanisms For example, what services do Digital Signatures provide? Demo

10. Product 1 ‘s Site Product 2 ‘s Site Product 3 ‘s Site Central Payment Site Signed XML POST

11. Principles:- Know what service each mechanism provides Do not implement crypto mechanisms yourself Use system provided methods

12. Book movie ticket Screen 1 for User 1

13. Book movie ticket Screen 2 for User 1 You have 7 minutes left Enter Payment details:- Name:- Credit Card Number:- Address:- … . Click to Book

14. Book movie ticket Screen 1 for User 2

15. Book movie ticket Screen 1 for User 2 after 7 minutes

16. Principles:- Use CAPTCHA to avoid automated attacks Design with security in mind