Lesson test: Authorization, and the whole thing assembled

Sign in

Libre University uses your GitHub account. Signing in is only needed to sit a final test, so the score is kept on your profile.

Authorization, and the whole thing assembled

1.[3p]
A handler calls `requireSession` and then fetches `db.invoice(request.params.id)`. What is missing?

Any check that this invoice belongs to this user, which is authorization rather than authentication

Correct

A second factor on the session

The answer is: Any check that this invoice belongs to this user, which is authorization rather than authentication

A CSRF token, since the request changes state

The answer is: Any check that this invoice belongs to this user, which is authorization rather than authentication

Rate limiting on the endpoint

The answer is: Any check that this invoice belongs to this user, which is authorization rather than authentication

2.[3p]
Why return 404 rather than 403 for a resource that exists but is not the caller's?

403 confirms the object exists, letting an attacker enumerate the ID space

Correct

403 is not a valid response to an authenticated request

The answer is: 403 confirms the object exists, letting an attacker enumerate the ID space

404 is cached by browsers and 403 is not

The answer is: 403 confirms the object exists, letting an attacker enumerate the ID space

403 reveals the owner's identity in the response body

The answer is: 403 confirms the object exists, letting an attacker enumerate the ID space

3.[2p]
Switching object IDs to random UUIDs removes the need for an ownership check.

True

The answer is: False

False

Correct

4.[3p]
With five separable capabilities, how many roles are needed to cover every non-empty combination?

CorrectNot quite: 31

5.[3p]
Why is migrating from roles to permissions much more expensive than starting with permissions?

Every call site must be reread to work out which specific right the role comparison stood for, and mistakes are silent both ways

Correct

Permission tables cannot be created once users exist

The answer is: Every call site must be reread to work out which specific right the role comparison stood for, and mistakes are silent both ways

Roles and permissions cannot both be checked during a transition

The answer is: Every call site must be reread to work out which specific right the role comparison stood for, and mistakes are silent both ways

The database migration locks the users table

The answer is: Every call site must be reread to work out which specific right the role comparison stood for, and mistakes are silent both ways

6.[3p]
Match each check to the layer that can actually make it.

Everything under /admin needs a permission
Only invoices in the caller's organisation
A refund above 1000 needs an extra right
Nothing at all is specified for this route

the handler, which can see the request body
denied by default
middleware matched on the route prefix
the data layer, which already has the object

Show the answer

Everything under /admin needs a permission: middleware matched on the route prefix Only invoices in the caller's organisation: the data layer, which already has the object A refund above 1000 needs an extra right: the handler, which can see the request body Nothing at all is specified for this route: denied by default

7.[3p]
Which of these count as trusting the client?

Select all that apply

Reading a role claim out of a JWT and acting on it

Correct

Accepting a price sent in a form body

Correct

Relying on a button being hidden in the interface

Correct

Reading the user ID from the session the server resolved

The answer is: Reading a `role` claim out of a JWT and acting on it, Accepting a price sent in a form body, Relying on a button being hidden in the interface

8.[3p]
Put the steps of a correct password reset in order.

Delete every session for that user and notify the address on file
Mint a random token, store its hash with a short expiry, and mail the link
Send the user to the login page rather than signing them in
Validate the token, change the password, and consume it in the same transaction

Show the answer

b, d, a, c

9.[2p]
What is the most common category of serious breach in real web applications? Two words.

CorrectNot quite: broken access control

1.[3p] A handler calls requireSession and then fetches db.invoice(request.params.id). What is missing?

2.[3p] Why return 404 rather than 403 for a resource that exists but is not the caller's?

3.[2p] Switching object IDs to random UUIDs removes the need for an ownership check.

4.[3p] With five separable capabilities, how many roles are needed to cover every non-empty combination?

5.[3p] Why is migrating from roles to permissions much more expensive than starting with permissions?

6.[3p] Match each check to the layer that can actually make it.

7.[3p] Which of these count as trusting the client?

8.[3p] Put the steps of a correct password reset in order.

9.[2p] What is the most common category of serious breach in real web applications? Two words.

1.[3p]
A handler calls `requireSession` and then fetches `db.invoice(request.params.id)`. What is missing?

2.[3p]
Why return 404 rather than 403 for a resource that exists but is not the caller's?

3.[2p]
Switching object IDs to random UUIDs removes the need for an ownership check.

4.[3p]
With five separable capabilities, how many roles are needed to cover every non-empty combination?

5.[3p]
Why is migrating from roles to permissions much more expensive than starting with permissions?

6.[3p]
Match each check to the layer that can actually make it.

7.[3p]
Which of these count as trusting the client?

8.[3p]
Put the steps of a correct password reset in order.

9.[2p]
What is the most common category of serious breach in real web applications? Two words.