None of this information was displayed in the application! Later I will propose why I think this happens. But first, here's a suggested way to check what's leaking out of your applications:
1) Empty your browser cache and all temp files. This makes it easier to find the interesting temp files later without having to wade through a quagmire of files from weeks and weeks of browsing.
2) Open the web application and do some queries on yourself, if possible (it will be easier to identify your own SSN, employee ID, address, credit card #, and other personal info about yourself--once you know where in the temp file to look, you can then look up the same info for others).
For example, do a search for your name or select your name from a drop down list, especially of a back-end database is used to populate other fields. The latest app I found this problem in was a help desk trouble ticket application. You clicked on the user name and it automatically queried the Human Resources database to populate the office location, phone number, etc., in the help ticket.
3) Note in the URL which server the application is being served from (you'll need this in the next step). For example, http://server2/webapp/main.html
4) Leave the web app open and open a new browser window. Some applications do another query back to the database when you open a temp file, believe it or not, so you need to leave the original browser window open.
5) Open the browser temp files and sort them by URL (called Internet Address in IE). Scroll down to the first URL that begins with the server name.
6) Look in the NAME column to the left and look for filenames containing words such as xml, retrieve, popup, and any filenames ending in asp (active server pages). Some files will have all of these keywords and others only one or two. XML documents pay the biggest dividends (and the goverment can't tax those dividends!).
For example, PopupRetrieveXML.asp ...
7) Open the temp files of interest (you can open all to be sure)--I usually open each one in a new window so that I don't break the web application link. Look for key info.
8) If you find anything, print it out and take it to your manager. And watch the eyeballs pop out!
Now, why does this happen? You can't see the data in the web application but it gets dumped to your temp files? My best guess...
The web app needs to get the data from a database, and along the way a programmer (either the web app programmer or the person that wrote the interface between the app and the database, and who knows, probably both) took the quick and dirty was of retrieving the information that was needed: go and grab all the info on person XYZ out of the database and yet only post to the application the specific fields that are needed.
In other words, if a database record about you contains fields such as your name, address, phone number, SSN, employee ID, salary rate (yikes!), department, and email address, it's easier and faster to code the interface to retrieve the entire record, EVEN THOUGH only the fields containing your name, address, phone number, and department are used in the application (in the help desk ticket example, which I mentioned earlier).
So we need to teach our programmers (call 'em developers if you want) to code for only what is required. But then the managers have to understand that it takes more time to code for each individual FIELD in a record rather than reading the entire record. But that requires managers to understand the need for security during coding. Either way, it's a BIG culture change. Coding fast and cheap to get the baby birthed and out the door is the name of the game.
That's why I favor showing upper management the data about THEM that they don't want you to know. That usually gets some action. Good luck!
