Ajax Security Question: Supplying Available usernames dynamically

Question

I am designing a simple registration form in ASP.net MVC 1.0 I want to allow the username to be validated while the user is typing (as per the related questions linked to below)

This is all easy enough. But what are the security implications of such a feature?

How do i avoid abuse from people scraping this to determine the list of valid usernames?

some related questions: 1, 2

Answer 1

To prevent against "malicious" activities on some of my internal ajax stuff, I add two GET variables one is the date (usually in epoch) then I take that date add a salt and SHA1 it, and also post that, if the date (when rehashed) does not match the hash then I drop the request otherwise fulfill it.

Of course I do the encryption before the page is rendered and pass the hash & date to the JS. Otherwise it would be meaningless.

The problem with using IP/cookie based limits is that both can be bypassed. Using a token method with a good, cryptographically strong, salt (say something like one of Steve Gibson's "Perfect Passwords" https://www.grc.com/passwords.htm ) it would take a HUGE amount of time (on the scale of decades) before the method could reliably be predicted and there for ensures a certain amount security.

Answer 2

you could limit the number of requests to maybe 2 per 10 seconds or so (a real user may put in a name that is taken and modify it a bit and try again). kind of like how SO doesn't let you comment more than once every 30 seconds.

if you're really worried about it, you could take a method above and count how many times they tried in a certain time period, and if it goes above a threshold, kick them to another page.

Answer 3

Validated as in: "This username is already taken"? If you limit the number of requests per second it should help

Answer 4

One common way to solve this is simply by adding a delay in the request. If the request is sent to the server, wait 1 (or more) seconds to respond, then respond with the result (if the name is valid or not).

Adding a time barrier doesn't really effect users not trying to scrape, and you have gotten a 60-requests per minute limit for free.

Answer 5

Bulding on the answer provided by UnkwnTech, which is some pretty solid advice.

You could go a step further and make the client perform some of calculation to create the return hash - this could just be some simple arithmatic like subtrating a few numbers, adding the data and multiplying by 2.

The added arithmatic does mean an out-of-box username scraping script is unlikely to work and forces the client into using up greater CPU.