Skip to main content

Insecure object reference - User deletion

Need​

Secure user deletion process and session management

Context​

  • Usage of Scala for building scalable and high-performance applications
  • Usage of play.api.mvc for handling HTTP requests and responses in Play Framework

Description​

Non compliant code​

import play.api.mvc._

class UserController @Inject()(cc: ControllerComponents) extends AbstractController(cc) {

  def deleteUser(userId: String) = Action { implicit request: Request[AnyContent] =>
    User.delete(userId)
    Ok("User deleted successfully")
  }
}

The deleteUser function in the UserController class is vulnerable to insecure object reference. This function takes a userId as a parameter and deletes the user without any checks or validations.

This is a serious vulnerability as it allows any user to delete any other user just by knowing their userId. Furthermore, after the user is deleted, their session is not invalidated which means they can continue browsing the application even after their user account has been deleted.

Here is an explanation of the code:

  1. import play.api.mvc._: This line is importing the necessary classes from the Play framework to handle HTTP requests and responses.

  2. class UserController @Inject()(cc: ControllerComponents) extends AbstractController(cc): This line is defining a new controller class UserController that extends the AbstractController class. The @Inject() annotation is used for dependency injection of ControllerComponents.

  3. def deleteUser(userId: String) = Action { implicit request: Request[AnyContent] =>: This line is defining a new action deleteUser that takes a userId as a parameter and an implicit request object.

  4. User.delete(userId): This line is calling the delete function of the User class with the userId as a parameter. This function deletes the user from the database.

  5. Ok("User deleted successfully"): This line is sending a HTTP 200 OK response with the message "User deleted successfully".

Steps​

  • Implement authentication and authorization mechanisms to ensure that only authorized users can delete other users.
  • Validate the user's permissions before allowing the deletion operation.
  • Ensure that the user's session is invalidated and terminated after the user is deleted.
  • Consider implementing a soft delete mechanism instead of permanently deleting users, to maintain data integrity and allow for potential recovery if needed.
  • Implement proper error handling and error messages to inform users about any issues during the deletion process.

Compliant code​

import play.api.mvc._
import play.api.libs.json.Json
import javax.inject.Inject

class UserController @Inject()(cc: ControllerComponents, authService: AuthService) extends AbstractController(cc) {

  def deleteUser(userId: String) = Action { implicit request: Request[AnyContent] =>
    val currentUser = authService.getCurrentUser(request)
    if (currentUser.isAdmin) {
      User.delete(userId)
      authService.invalidateSession(request)
      Ok(Json.obj("message" -> "User deleted successfully"))
    } else {
      Unauthorized(Json.obj("message" -> "You are not authorized to perform this action"))
    }
  }
}

The updated code now includes an AuthService which is used to get the current user and check if they have admin permissions. If the current user is an admin, they are allowed to delete the user and the session is invalidated immediately after the user is deleted. If the current user is not an admin, an Unauthorized response is returned.

The AuthService is a hypothetical service and its implementation is not shown here. It should provide methods to authenticate users and manage user sessions. The getCurrentUser(request) method should return the current user based on the request, and the invalidateSession(request) method should invalidate and terminate the user's session.

The User.delete(userId) method is also hypothetical and its implementation is not shown here. It should delete the user with the given userId from the database. Consider implementing a soft delete mechanism instead of permanently deleting users.

The response now includes a JSON object with a message field. This provides a more structured response and allows for easier error handling on the client side.

Remember to handle exceptions and edge cases appropriately. For example, what if the userId does not exist in the database? What if the AuthService fails to invalidate the session? These are scenarios that should be considered and handled in your code.

References​

Last updated on