2

we are developing a windows application, and as most apps out there, there is a login form. What I don't like is that the login form validates the user and opens the main form if user and pass are correct. Simple as is.

All the function calls etc are called without verifying the user and pass again, what should be the right thing to do.

What's the best way to develop a secured application that if for any reason, the login form is by passed, the other function calls won't run?

Some devs suggested that we include an user and pass params on each function, which seems to be wrong...

thanks!

2
  • Are you developping this application on a closed domain? Is this being developped for a specific company? Mar 30, 2010 at 17:33
  • yes, and no... it will be used by customers
    – John S
    Mar 30, 2010 at 19:33

5 Answers 5

3

(Misread your post and initially thought you were talking about web forms, so scratch the original answer)

If everything is running through your app, you control if they go through the login form or not, unless you're launching a separate .exe. Unless it's something that needs extra high security measures, you should be safe knowing the user is logged in.

It's hard to say exactly the best way to go without knowing more about your application. At the most basic level, you can set a global variable when the user is logged in and just check that before doing anything else in each of your functions.

1
  • I think he is talking about winForms though
    – Pondidum
    Mar 30, 2010 at 15:15
1

If this is an application that runs on the user's PC, then there really is no way to secure it. It can be disassembled and disected and reassembled at the user's whim.

There are ways of obfuscating the code, but there isn't really any way to secure it.

There are ways to authenticate and secure external resources like a database or web service, though.

0

I agree with Shawn. But if you want to do it manually(assuming that you are using asp.net), then I have used this: 1) when the user is authenticated, I issue an authentication ticket in which the username, timestamp and his priviledges are encrypted and stored. I store this ticket in a cookie. 2) In each page, I include an authentication function in the page_preload event handler. This function reads the ticket from the cookie, decrypts it and checks the username, timestamp and privilege. That way I can make sure that 1) the user has passed thro' login page, 2) he hasn't timed out 3) he is using the page with the required privileges. If any of the info appears to be invalid, then he is redirected to the login page.

So you will need to access the database only once for authentication ie. on login page. For the subsequent requests, you simply need to decrypt the authentication ticket and check whether it contains valid data.

This might cause a little overhead, but if security is important, then this overhead might be tolreable.

Hope this helps, vamyip

0

All of your permissions should be re-validated in the 2nd and possibly 3rd tier. Your App is only the 1st tier.

If you're combining all 3 tiers into the app itself, then you DO need a way to track permissions.

0

if you're using ASP.NET, why store the ticket in the cookie? Just put it in a session variable, let ASP handle the cookies. This way no vital info is stored in the cookie, just in the server's memory.

The first tier, which is what the client sees, should only display and let the user attempt to change what they have access to.

Someone may find a loop hole in the first tier, so the second tier should ALWAYS validate all requests before forwarding on the request to the third tier. The third tier is just your data and should have logical constraints to make sure the data remains clean, but not much about security.

The only way to make sure your 2nd and 3rd tier are "safe" is to have them on different servers. Any time you don't trust the client or security is priority, the 2nd and 3rd tier should NOT be in the client app.

Typically, the 1st tier is hackable, which is why you validate also on the 2nd tier. If the 2nd and 3rd tier is on the client side, then they are also hackable.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.