Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

With todays browser extensions/tools is it not easily possible for a user to edit the html/css settings of a website and so enable some disabled buttons etc... to gain access to not permitted areas?

share|improve this question

3 Answers 3

up vote 3 down vote accepted

Yes it's possible to manipulate anything in the client side, which includes HTML, CSS, and JavaScript. However the original client side code is stored in the server, and while you can manipulate it, if you do not have access to the server you can not save your changes. Refreshing your browser essentially means requesting a fresh copy of the client side code, so all changes to your local copy will vanish.

As for restricted areas, let's say for example a login form. While you can change the colors and/or size of the password input box, the code that validates whether the password is correct resides on the server, you have no access to it, and your client side changes doesn't affect it, so there's nothing to worry about.

share|improve this answer
2  
Well, the validation should be on the server. What you explain is precisely why those who don't put it there are do it horribly wrong. –  delnan May 18 '12 at 18:16

Assuming that your statement of enabling previously disabled buttons or links through the browser dev tools means that the user then gets access to an area of the application they otherwise wouldn't have, you're referring to what's known as an authorization vulnerability. In this case, the security is reliant on the presentation layer to enforce it, which as you know, is easy to circumvent.

The best defense against this is to perform your authorization in both the presentation layer (browser) and the business layer (server). Always validate and authorize user requests on the server. Doing so in the browser is usually recommended to improve the user experience (i.e., don't show me links to functions I can't do because it's just visual noise to parse through) and it hides functionality that would otherwise be inadvertently communicated. Only show what you have to, but validate and authorize everything on the server.

share|improve this answer

It depends on what those files contain.

For example, let's say that person A has a website. This website has a link (or button or whatever) to some web page which should only be available to administrators, with stuff used in debugging (like clearing the database for example). When he the site goes live, he decides that instead of removing the link and the debugging code, he only comments out the link and leaves in the debugging stuff. Boom! You can imagine that anyone can see the comment by viewing the source of the page in any browser.

But then again, this type of things only happen because of human error (and maybe stupidity). I for one haven't seen this stuff ever in my life and would be amazed if I ever did.

If you build a website right and don`t leave any nasty stuff in your code then you are all fine.

When you visit a website you only get files which describe what you see on the screen. As for the functionality (scripting) part, these come in two different flavors. First there is the client side scripting and unless you want to harm yourself, there's not much you can do with it. Second, there is the server side scripting which does contain code for connecting to the database and retrieving information and such, but you NEVER receive it (secrets :P).

In the end, there are possibilities for bod things to happen from html and css but you really, really, really have to go out of your to enable them.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.