ASP.NET MVC Tip #15 – Pass Browser Cookies and Server Variables as Action Parameters

MVC Controller Action Security Hole « SquaredRoot

MVC Controller Action Security Hole « SquaredRoot — Tue, 09 Jun 2009 02:29:03 GMT

Pingback from MVC Controller Action Security Hole « SquaredRoot

re: ASP.NET MVC Tip #15 – Pass Browser Cookies and Server Variables as Action Parameters

VB — Wed, 23 Jul 2008 15:27:15 GMT

Hi Stephen,

I am new to MVC and was wondering when you pass action parameters Is there any way NOT TO DISPLAY them in the url?

for eg: http://localhost/mvcapp/blogs/24">localhost/.../24

can we display this as

http://localhost/mvcapp/blogs/

or maybe some other way where we do not display the parameter to the user?

Thanks

re: ASP.NET MVC Tip #15 – Pass Browser Cookies and Server Variables as Action Parameters

Dylan Beattie — Thu, 10 Jul 2008 20:01:19 GMT

Exactly as tf124 said... how do you combine these techniques with something like Html.BuildUrlFromExpression() or Html.ActionLink<T>() ?

These methods won't compile unless you specify their arguments in the method call - so how can you refer to them within pages and still use the automatic parameter population features?

Great article, though - thanks!

links for 2008-07-10 « Praveen’s Blog

links for 2008-07-10 « Praveen’s Blog — Thu, 10 Jul 2008 10:48:59 GMT

Pingback from links for 2008-07-10 « Praveen’s Blog

re: ASP.NET MVC Tip #15 – Pass Browser Cookies and Server Variables as Action Parameters

tf124 — Wed, 09 Jul 2008 16:34:52 GMT

So... how could I link to a controller that accepts server variables via an Html.ActionLink. It would get a compile error if you don't specify all the parameters... yet that would be exactly what I want to do... not specify the parameters and have them filled in for me.

re: ASP.NET MVC Tip #15 – Pass Browser Cookies and Server Variables as Action Parameters

Haacked — Wed, 09 Jul 2008 06:29:24 GMT

I wrote a blog post that addresses the fundamental security issue in this case, which is not passing server vars into an action method. haacked.com/.../user-input-in-sheep-clothing.aspx

User Input In Sheep

you've been HAACKED — Wed, 09 Jul 2008 06:27:56 GMT

User Input In Sheep

MVC Controller Action Security Hole

Troy Goode: SquaredRoot — Wed, 09 Jul 2008 02:00:44 GMT

MVC Controller Action Security Hole

re: ASP.NET MVC Tip #15 – Pass Browser Cookies and Server Variables as Action Parameters

Troy Goode — Tue, 08 Jul 2008 22:22:19 GMT

Thanks for the tip Stephen, specifically about passing cookies in.

Unfortunately I think Francois is 100% on point regarding the security implications of passing server variables this way. I've examined some potential pitfalls on my blog:

www.squaredroot.com/.../MVC-Routing-Security-Hole.aspx

MVC Routing Security Hole

Troy Goode: SquaredRoot — Tue, 08 Jul 2008 22:14:56 GMT

MVC Routing Security Hole