Skip to content

Commit 42ee72c

Browse files
AndriiPiatakhaAndriiPiatakha
committed
Broken Authentication - Demo
1 parent 6f7f9cc commit 42ee72c

File tree

6 files changed

+392
-69
lines changed

6 files changed

+392
-69
lines changed

‎online-store.web/pom.xml

Lines changed: 93 additions & 69 deletions
Original file line numberDiff line numberDiff line change
@@ -1,81 +1,105 @@
1-
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
1+
<project xmlns="http://maven.apache.org/POM/4.0.0"
2+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
3+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
24

3-
<parent>
4-
<groupId>com.itbulls.learnit</groupId>
5-
<artifactId>online-store</artifactId>
6-
<version>${project.version}</version>
7-
</parent>
8-
<modelVersion>4.0.0</modelVersion>
5+
<parent>
6+
<groupId>com.itbulls.learnit</groupId>
7+
<artifactId>online-store</artifactId>
8+
<version>${project.version}</version>
9+
</parent>
10+
<modelVersion>4.0.0</modelVersion>
911

10-
<groupId>com.itbulls.learnit</groupId>
11-
<artifactId>online-store.web</artifactId>
12-
<version>${project.version}</version>
13-
<packaging>war</packaging>
12+
<groupId>com.itbulls.learnit</groupId>
13+
<artifactId>online-store.web</artifactId>
14+
<version>${project.version}</version>
15+
<packaging>war</packaging>
1416

1517

16-
<dependencies>
17-
<dependency>
18-
<groupId>jakarta.servlet</groupId>
19-
<artifactId>jakarta.servlet-api</artifactId>
20-
<version>5.0.0</version>
21-
<scope>provided</scope>
22-
</dependency>
18+
<dependencies>
19+
<dependency>
20+
<groupId>jakarta.servlet</groupId>
21+
<artifactId>jakarta.servlet-api</artifactId>
22+
<version>5.0.0</version>
23+
<scope>provided</scope>
24+
</dependency>
2325

24-
<dependency>
25-
<groupId>org.glassfish.web</groupId>
26-
<artifactId>jakarta.servlet.jsp.jstl</artifactId>
27-
<version>2.0.0</version>
28-
</dependency>
26+
<dependency>
27+
<groupId>org.glassfish.web</groupId>
28+
<artifactId>jakarta.servlet.jsp.jstl</artifactId>
29+
<version>2.0.0</version>
30+
</dependency>
2931

30-
<dependency>
31-
<groupId>com.learnit.itbulls</groupId>
32-
<artifactId>online-store.core</artifactId>
33-
<version>${project.version}</version>
34-
</dependency>
32+
<dependency>
33+
<groupId>com.learnit.itbulls</groupId>
34+
<artifactId>online-store.core</artifactId>
35+
<version>${project.version}</version>
36+
</dependency>
3537

36-
<dependency>
37-
<groupId>org.apache.tomcat</groupId>
38-
<artifactId>tomcat-jsp-api</artifactId>
39-
<version>10.0.0-M10</version>
40-
<scope>provided</scope>
41-
</dependency>
38+
<dependency>
39+
<groupId>org.apache.tomcat</groupId>
40+
<artifactId>tomcat-jsp-api</artifactId>
41+
<version>10.0.0-M10</version>
42+
<scope>provided</scope>
43+
</dependency>
4244

43-
<dependency>
44-
<groupId>jakarta.annotation</groupId>
45-
<artifactId>jakarta.annotation-api</artifactId>
46-
<version>2.1.0</version>
47-
</dependency>
45+
<dependency>
46+
<groupId>jakarta.annotation</groupId>
47+
<artifactId>jakarta.annotation-api</artifactId>
48+
<version>2.1.0</version>
49+
</dependency>
4850

51+
<dependency>
52+
<groupId>io.jsonwebtoken</groupId>
53+
<artifactId>jjwt-api</artifactId>
54+
<version>0.12.6</version>
55+
</dependency>
56+
<dependency>
57+
<groupId>io.jsonwebtoken</groupId>
58+
<artifactId>jjwt-impl</artifactId>
59+
<version>0.12.6</version>
60+
</dependency>
61+
<dependency>
62+
<groupId>io.jsonwebtoken</groupId>
63+
<artifactId>jjwt-jackson</artifactId>
64+
<version>0.12.6</version>
65+
</dependency>
4966

50-
</dependencies>
67+
<dependency>
68+
<groupId>com.google.code.gson</groupId>
69+
<artifactId>gson</artifactId>
70+
<version>2.11.0</version>
71+
</dependency>
5172

52-
<build>
53-
<resources>
54-
<resource>
55-
<directory>src/main/webapp</directory>
56-
<excludes>
57-
<exclude>**/*.java</exclude>
58-
</excludes>
59-
</resource>
60-
<resource>
61-
<directory>src/main/resources</directory>
62-
<excludes>
63-
<exclude>**/*.java</exclude>
64-
</excludes>
65-
</resource>
66-
</resources>
67-
<plugins>
68-
<plugin>
69-
<artifactId>maven-compiler-plugin</artifactId>
70-
<version>3.8.1</version>
71-
<configuration>
72-
<release>15</release>
73-
</configuration>
74-
</plugin>
75-
<plugin>
76-
<artifactId>maven-war-plugin</artifactId>
77-
<version>3.2.3</version>
78-
</plugin>
79-
</plugins>
80-
</build>
73+
74+
</dependencies>
75+
76+
<build>
77+
<resources>
78+
<resource>
79+
<directory>src/main/webapp</directory>
80+
<excludes>
81+
<exclude>**/*.java</exclude>
82+
</excludes>
83+
</resource>
84+
<resource>
85+
<directory>src/main/resources</directory>
86+
<excludes>
87+
<exclude>**/*.java</exclude>
88+
</excludes>
89+
</resource>
90+
</resources>
91+
<plugins>
92+
<plugin>
93+
<artifactId>maven-compiler-plugin</artifactId>
94+
<version>3.8.1</version>
95+
<configuration>
96+
<release>15</release>
97+
</configuration>
98+
</plugin>
99+
<plugin>
100+
<artifactId>maven-war-plugin</artifactId>
101+
<version>3.2.3</version>
102+
</plugin>
103+
</plugins>
104+
</build>
81105
</project>

‎online-store.web/src/main/java/com/itbulls/learnit/onlinestore/web/owasp/ba/problem/InsecureAuthenticationServlet.java

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
package com.itbulls.learnit.onlinestore.web.owasp.ba.problem;
2+
3+
import java.io.IOException;
4+
5+
import com.itbulls.learnit.onlinestore.core.facades.UserFacade;
6+
import com.itbulls.learnit.onlinestore.core.facades.impl.DefaultUserFacade;
7+
import com.itbulls.learnit.onlinestore.persistence.enteties.User;
8+
9+
import jakarta.servlet.ServletException;
10+
import jakarta.servlet.annotation.WebServlet;
11+
import jakarta.servlet.http.HttpServlet;
12+
import jakarta.servlet.http.HttpServletRequest;
13+
import jakarta.servlet.http.HttpServletResponse;
14+
15+
@WebServlet("/insecure-auth-servlet")
16+
public class InsecureAuthenticationServlet extends HttpServlet {
17+
18+
private UserFacade userFacade = DefaultUserFacade.getInstance();
19+
20+
@Override
21+
protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
22+
String email = req.getParameter("email");
23+
String password = req.getParameter("password");
24+
25+
User user = userFacade.getUserByEmail(email);
26+
27+
if (user != null && user.getPassword().equals(password)) {
28+
String token = generateWeakToken(email);
29+
resp.setContentType("application/json");
30+
resp.getWriter().write("{\"token\": \"" + token + "\"}");
31+
resp.setStatus(HttpServletResponse.SC_OK);
32+
} else {
33+
resp.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
34+
}
35+
}
36+
37+
private String generateWeakToken(String email) {
38+
// Weak token generation using email only, no expiration policy, easy to guess
39+
return "token_" + email;
40+
}
41+
}

‎online-store.web/src/main/java/com/itbulls/learnit/onlinestore/web/owasp/ba/problem/InsecureGetUserDataServlet.java

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
package com.itbulls.learnit.onlinestore.web.owasp.ba.problem;
2+
3+
import java.io.IOException;
4+
5+
import com.google.gson.Gson;
6+
import com.itbulls.learnit.onlinestore.core.facades.UserFacade;
7+
import com.itbulls.learnit.onlinestore.core.facades.impl.DefaultUserFacade;
8+
import com.itbulls.learnit.onlinestore.persistence.enteties.User;
9+
10+
import jakarta.servlet.ServletException;
11+
import jakarta.servlet.annotation.WebServlet;
12+
import jakarta.servlet.http.HttpServlet;
13+
import jakarta.servlet.http.HttpServletRequest;
14+
import jakarta.servlet.http.HttpServletResponse;
15+
16+
@WebServlet("/insecure-get-user-data")
17+
public class InsecureGetUserDataServlet extends HttpServlet {
18+
19+
private UserFacade userFacade = DefaultUserFacade.getInstance();
20+
private final Gson gson = new Gson();
21+
22+
@Override
23+
protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
24+
String authHeader = req.getHeader("Authorization");
25+
26+
if (authHeader != null && authHeader.startsWith("Bearer ")) {
27+
String token = authHeader.substring(7);
28+
String email = validateWeakToken(token);
29+
if (email != null) {
30+
User userData = userFacade.getUserByEmail(email);
31+
resp.setContentType("application/json");
32+
resp.getWriter().write("{\"data\": \"" + gson.toJson(userData) + "\"}");
33+
resp.setStatus(HttpServletResponse.SC_OK);
34+
} else {
35+
resp.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
36+
}
37+
} else {
38+
resp.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
39+
}
40+
}
41+
42+
private String validateWeakToken(String token) {
43+
// Improper token validation, just extracts the email without verifying integrity
44+
if (token.startsWith("token_")) {
45+
return token.substring(6);
46+
}
47+
return null;
48+
}
49+
50+
}

‎online-store.web/src/main/java/com/itbulls/learnit/onlinestore/web/owasp/ba/solution/GetUserDataServlet.java

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
package com.itbulls.learnit.onlinestore.web.owasp.ba.solution;
2+
3+
import jakarta.servlet.ServletException;
4+
import jakarta.servlet.annotation.WebServlet;
5+
import jakarta.servlet.http.HttpServlet;
6+
import jakarta.servlet.http.HttpServletRequest;
7+
import jakarta.servlet.http.HttpServletResponse;
8+
import java.io.IOException;
9+
10+
import com.itbulls.learnit.onlinestore.core.facades.impl.DefaultUserFacade;
11+
import com.itbulls.learnit.onlinestore.core.facades.UserFacade;
12+
import com.itbulls.learnit.onlinestore.persistence.enteties.User;
13+
import com.google.gson.Gson;
14+
15+
@WebServlet("/protected-endpoint-get-user-data")
16+
public class GetUserDataServlet extends HttpServlet {
17+
18+
private UserFacade userFacade = DefaultUserFacade.getInstance();
19+
private final Gson gson = new Gson();
20+
21+
@Override
22+
protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
23+
String authHeader = req.getHeader("Authorization");
24+
25+
if (authHeader != null && authHeader.startsWith("Bearer ")) {
26+
String token = authHeader.substring(7);
27+
if (JwtUtils.isTokenValid(token)) {
28+
try {
29+
String userEmail = JwtUtils.parseToken(token).getPayload().getSubject();
30+
System.out.println("User Email: " + userEmail);
31+
User userData = userFacade.getUserByEmail(userEmail);
32+
resp.setContentType("application/json");
33+
resp.getWriter().write("{\"data\": \"" + gson.toJson(userData) + "\"}");
34+
resp.setStatus(HttpServletResponse.SC_OK);
35+
} catch (Exception e) {
36+
e.printStackTrace();
37+
}
38+
39+
} else {
40+
resp.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
41+
}
42+
} else {
43+
resp.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
44+
}
45+
}
46+
}

‎online-store.web/src/main/java/com/itbulls/learnit/onlinestore/web/owasp/ba/solution/JwtUtils.java

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
package com.itbulls.learnit.onlinestore.web.owasp.ba.solution;
2+
3+
import java.util.Base64;
4+
import java.util.Date;
5+
6+
import javax.crypto.SecretKey;
7+
8+
import io.jsonwebtoken.Claims;
9+
import io.jsonwebtoken.Jws;
10+
import io.jsonwebtoken.JwtParser;
11+
import io.jsonwebtoken.Jwts;
12+
import io.jsonwebtoken.security.Keys;
13+
14+
public class JwtUtils {
15+
16+
// TODO - NEVER STORE SECRET KEYS IN THE SOURCE CODE! Use Secrets Key Vaults
17+
// The secret key as a Base64-encoded string representation
18+
private static final String SECRET_KEY_STRING = "b2g82k9ZmBrfY8fd/72Q6nMsdzH8fWgYyPw7TtD5FzI="; // Replace with your actual secure secret key
19+
20+
// TODO - NEVER STORE SECRET KEYS IN THE SOURCE CODE! Use Secrets Key Vaults
21+
// Create a SecretKey instance for signing and verification
22+
private static final SecretKey SECRET_KEY = Keys.hmacShaKeyFor(Base64.getDecoder().decode(SECRET_KEY_STRING));
23+
24+
/**
25+
* Generates a JWT token for the given user email.
26+
*
27+
* @param user email the email to include in the token.
28+
* @return the generated JWT token as a string.
29+
*/
30+
public static String generateToken(String userEmail) {
31+
32+
return Jwts.builder().subject(userEmail).issuedAt(new Date())
33+
.expiration(new Date(System.currentTimeMillis() + 864_000_000)) // 10 days
34+
.signWith(SECRET_KEY) // Sign the token with the SecretKeySpec
35+
.compact();
36+
}
37+
38+
39+
/**
40+
* Validates the JWT token.
41+
*
42+
* @param token the JWT token to validate.
43+
* @return true if the token is valid, false otherwise.
44+
*/
45+
public static boolean isTokenValid(String token) {
46+
JwtParser jwtParser = Jwts.parser().verifyWith(SECRET_KEY).build();
47+
try {
48+
jwtParser.parse(token);
49+
return true;
50+
} catch (Exception e) {
51+
System.err.println("Could not verify JWT token integrity! Exception: " + e.getMessage());
52+
return false;
53+
}
54+
55+
}
56+
57+
58+
public static Jws<Claims> parseToken(String token) {
59+
JwtParser jwtParser = Jwts.parser().verifyWith(SECRET_KEY).build();
60+
return jwtParser.parseSignedClaims(token);
61+
}
62+
}

0 commit comments

Comments
 (0)