Forum Discussion

R__Winters_7757's avatar
R__Winters_7757
Icon for Nimbostratus rankNimbostratus
Oct 21, 2010

Allowing default-disallowed characters

We are having an issue where users are getting blocked when they try and create or use a password that contains % or @. As these characters are disallowed by default, we are considering allowing them for this parameter.

 

 

My question is what security risks are we facing by allowing these characters? The application is ASP.NET and the parameter is never echoed back to the user.

 

APM
app sec
security

1 Reply

Sort By
  • hooleylist's avatar
    hooleylist
    Icon for Cirrostratus rankCirrostratus
    Oct 21, 2010
    If the characters legitimately need to be used in the app, I wouldn't hesitate to relax the policy. Password fields are generally one parameter where you allow all standard ascii metacharacters assuming the application allows them. You can still use the attack sigs to provide protection.

     

     

    Aaron