Url spoofing

HCL Domino Domino Forum
1

Hi Pals,

We have a problem in our application where users can spoof thier URl.

Consider an application which is having 3 frames in a framset

Normally my URL remains the same “http://servername/dbname.nsf”

A user enters the value like “http://servername/dbname.nsf/pgapps?openpage&location=http://www.google.com” then in the middle frame the google website gets opened . We dont want this to happen how to restrict this .

I tried this in this site with this URL http://www-10.lotus.com/ldd/46dom.nsf/Search?openView&location=http://www.google.com" here the google site is not opened the page remains the same …

Any suggestions or ideas would be appreciated…

Domino version 6.5

thx in advance…

Regds,

Sathish.S

2

Subject: URL SPOOFING

we can not stop the user from changing the URL. So we need to do the check in the application only either on the Web Query Open or the on-load event of the form/page.

Whenever we find that user is trying to add the location= … in the URL we can stop by either loading the default URL or some other Error page.

3

Subject: URL SPOOFING

it appears by review of the page source that there are no frames in effect here - so the comparison is not valid