What is a Clientside Authentication?
Authentication is the mechanism through which a user proves their identity. Once this has been confirmed, the user is authorized for identity specific privileges.
Clientside authentication is specifically when authentication checks are performed on the client. The authentication procedures, methods, and software are delivered to the client, where they are executed to establish identity and potentially access privileges.
Delivering the intricacies of authentication procedures to the user enables an attacker to use client side tools to look deep into the code. As a result, authentication bypass, sensitive information disclosure and credentials leakage are extremely high.
An example of authentication bypass
Regardless of the result of the authentication process on the client, an attacker can replace the response to the server with something that will grant them access.
If a complete table of usernames and passwords is provided to the client, it might also be possible for an attacker to perform full database exfiltration.
RedShield Securing Client Side Authentication
The crux of the vulnerability is that the authentication procedure and data should not be passed to the client.
The basis of the defense is for RedShield to be a trusted Man-In-The-Middle. The server effectively views RedShield as the client, whilst the client views RedShield as the server. With this architecture RedShield can knit together 2 independent transactions to remove exploitability.
The process is as follows:
- The server sends the exploitable response with authentication process to RedShield
- RedShield stores the authentication process and rewrites the response to request relevant data to be securely sent by the client
- The Client sends a secure request with the required data to RedShield
- RedShield extracts the data and uses that as inputs to the authentication process, the result of which is forwarded to the server