Forum Discussion

schusb's avatar
schusb
Icon for Nimbostratus rankNimbostratus
Nov 06, 2017

ASM block requests with modified readonly attribute values

Is there a way to block requests whose form was tampered at client side so that a the value of a readonly html input element was set to a new value?

UPDATE:

We've a input field which has set the readonly attribute if the user is in a specific role, hence it's not editable for him but for users with a more privileged role it is possible to change that value.

Sadly!!!, there's no further validation in place. We want to save the pain of implementing the missing validation layer for this quite old application. It would be a huge benefint to usif the ASM- module is able to validate the 

readonly
attribute values against the corresponding value from the response. In case of a mismatch, the attacker has tamperd the inputfield and we want the ASM-module to generate an error.

Thanks, a bunch!

ASM Advanced WAF
big-ip 12.1.2
html form elements
security
tampering
  • boneyard's avatar
    boneyard
    Icon for MVP rankMVP
    Nov 06, 2017

    cjunior is suggesting (i believe) to add that readonly variable and only allow it with the value "readonly".

     

    but im not sure that is what you want, you want a double check, if the readonly=readonly then the value= can't be changed right?

     

    if you require that double logic, so the value for one variable determines something of another variable then i don't believe that is possible.