Alik Levin's

Clarity, Technology, and Solving Problems | PracticeThis.com

Performance Gain - Security Risk

Performance Gain - Security Risk

  • Comments 4

Reposted from Performance Gain - Security Risk

Good intention for better performance may lead to flawed design and bring in more security risks.

Consider the following ASPX page:

Here is why it cannot be accessed:

When trying to navigate there you get:

 

Great, love URL authorization!!

 

Now let's examine another ASPX page:

When navigating to this page you surprisingly get this:

The reason for that is when using Server.Transfer the request to the second page does not go through the whole ASP.NET pipeline which includes URL Authorization module

Security part is here http://msdn2.microsoft.com/en-us/library/ms998375.aspx

Performance part is here http://msdn2.microsoft.com/en-us/library/ms998549.aspx 

Performance and Security has never been good friends - fortunately we have J.D. who is bridging the two letting us enjoy both.

 

Enjoy

  • Server.Transfer raises ThreadAbortException,

    so it may be faster, but not scalable.

    There are also other disadvantages like you mentioned.

  • Anatoly, thanks for comment!

    In my post i did not try to show Server.Transfer as disadvatageous one - not at all. I tried to make one aware what Server.Trasnfer may cause as a result of flawed design.

    BTW,  - you have very nice blog

  • Care about performance? Do you write your code with performance in mind? Want little help to spot performance

  • These are the questions and the search criteria I use to identify authorization vulnerabilities in the

Page 1 of 1 (4 items)