I am working on a PHP project. So far I have taken care of XSS, SQL injections, SQL truncation attacks, CSRF, Chain attacks, Header injections, Session fixation, Session hijacking, Session poisoning, Cookie forging, Session forging, Register globals, Remote code attacks, Brute Force attacks and I have some other security features such as Installer lock, Data hashing, Session management, CAPTCHA, IP banning, Advanced hidden/logged error reporting, Magic Quotes are being handled, etc.
But one thing that I am not sure about is the man-in-the-middle type of attacks. How would you protect from those type of attacks?
I would like to discuss seriously with Security professionals about this issue.
Also I have a couple of questions if anyone might know the answer:
1) Is it ok to block all proxies from logging in? I think that some people might get in trouble, like in the work if they have a one big proxy system or something like that? Isn't AOL also some sort of 'proxy' type? I do not know about this especially since I'm east european I never really knew about AOL much.
2) Many scripts have a IP detection like:
Code: Select all
if (isset($_SERVER['HTTP_X_FORWARDED_FOR']))
$ip = ...Looking forward to some talk