Skip to main content

Improper authorization control for web services

Need​

Implementation of proper authorization control for web services

Context​

  • Usage of Scala for building scalable and functional applications
  • Usage of play.api for building web applications in Scala
  • Usage of play.api.mvc for handling HTTP requests in Play Framework

Description​

Non compliant code​

package controllers

import play.api._
import play.api.mvc._

class ServiceController extends Controller {

  def getData(id: String) = Action {
    val data = ServiceModel.findById(id)
    Ok(data)
  }

}

In the above code, the getData method in ServiceController is vulnerable because it does not implement any form of authorization control. This means that any client can invoke this method with any id and retrieve the associated data, which can lead to unauthorized access of sensitive information.

The getData method is an endpoint that retrieves data from the ServiceModel by the given id. However, there is no check to see if the client making the request has the appropriate permissions to access the data associated with the id.

This vulnerability can be exploited by an attacker who could potentially access and retrieve sensitive data. They just need to know the id of the data they want to access. This could lead to a serious data breach.

The vulnerability exists because the application does not verify if the requestor has the appropriate permissions to access the data. This is a violation of the principle of least privilege, which states that a process should only be given those privileges which are essential to its function.

Steps​

  • Implement an authentication mechanism to verify the identity of the user making the request.
  • Implement an authorization mechanism to control access to the web service based on the user's role or permissions.
  • Ensure that only authorized users can access the web service by validating their credentials.
  • Use a secure session management mechanism to maintain the user's authentication state.
  • Apply the principle of least privilege by granting users only the necessary permissions to access the web service.
  • Regularly review and update the authorization control mechanism to address any new security vulnerabilities or changes in user roles and permissions.

Compliant code​

package controllers

import play.api._
import play.api.mvc._
import play.api.mvc.Security.Authenticated

class ServiceController extends Controller {

  def AuthenticatedAction(f: Request[AnyContent] => Result): Action[AnyContent] = {
    Action { request =>
      request.session.get("username").map { user =>
        f(request)
      }.getOrElse {
        Unauthorized("Oops, you are not connected")
      }
    }
  }

  def getData(id: String) = AuthenticatedAction { request =>
    val data = ServiceModel.findById(id)
    Ok(data)
  }
}

The updated code now includes an AuthenticatedAction method that checks if the user is authenticated before allowing them to access the getData method. This is done by checking if the "username" exists in the session. If it does, the user is considered authenticated and the action is executed. If not, an Unauthorized response is returned.

The getData method now uses this AuthenticatedAction instead of the generic Action. This ensures that only authenticated users can access the data.

Please note that this is a simple example and real-world applications may require more complex authentication and authorization mechanisms. For example, you might want to check the user's role or permissions before allowing them to access certain actions. You might also want to use a more secure way to store the user's authentication state, such as encrypted cookies or tokens.

Also, remember to apply the principle of least privilege by granting users only the necessary permissions to access the web service. Regularly review and update the authorization control mechanism to address any new security vulnerabilities or changes in user roles and permissions.

References​

Last updated on