Authorization, and the whole thing assembled
1.[3p] A handler calls requireSession and then fetches db.invoice(request.params.id). What is missing?
A handler calls requireSession and then fetches db.invoice(request.params.id). What is missing?
The answer is: Any check that this invoice belongs to this user, which is authorization rather than authentication
The answer is: Any check that this invoice belongs to this user, which is authorization rather than authentication
The answer is: Any check that this invoice belongs to this user, which is authorization rather than authentication
2.[3p] Why return 404 rather than 403 for a resource that exists but is not the caller's?
Why return 404 rather than 403 for a resource that exists but is not the caller's?
The answer is: 403 confirms the object exists, letting an attacker enumerate the ID space
The answer is: 403 confirms the object exists, letting an attacker enumerate the ID space
The answer is: 403 confirms the object exists, letting an attacker enumerate the ID space
3.[2p] Switching object IDs to random UUIDs removes the need for an ownership check.
Switching object IDs to random UUIDs removes the need for an ownership check.
The answer is: False
4.[3p] With five separable capabilities, how many roles are needed to cover every non-empty combination?
With five separable capabilities, how many roles are needed to cover every non-empty combination?
5.[3p] Why is migrating from roles to permissions much more expensive than starting with permissions?
Why is migrating from roles to permissions much more expensive than starting with permissions?
The answer is: Every call site must be reread to work out which specific right the role comparison stood for, and mistakes are silent both ways
The answer is: Every call site must be reread to work out which specific right the role comparison stood for, and mistakes are silent both ways
The answer is: Every call site must be reread to work out which specific right the role comparison stood for, and mistakes are silent both ways
6.[3p] Match each check to the layer that can actually make it.
Match each check to the layer that can actually make it.
Everything under /admin needs a permission
Only invoices in the caller's organisation
A refund above 1000 needs an extra right
Nothing at all is specified for this route
the handler, which can see the request body
denied by default
middleware matched on the route prefix
the data layer, which already has the object
Show the answer
Everything under /admin needs a permission: middleware matched on the route prefix Only invoices in the caller's organisation: the data layer, which already has the object A refund above 1000 needs an extra right: the handler, which can see the request body Nothing at all is specified for this route: denied by default
7.[3p] Which of these count as trusting the client?
Which of these count as trusting the client?
Select all that apply
The answer is: Reading a role claim out of a JWT and acting on it, Accepting a price sent in a form body, Relying on a button being hidden in the interface
8.[3p] Put the steps of a correct password reset in order.
Put the steps of a correct password reset in order.
Delete every session for that user and notify the address on file
Mint a random token, store its hash with a short expiry, and mail the link
Send the user to the login page rather than signing them in
Validate the token, change the password, and consume it in the same transaction
Show the answer
b, d, a, c
9.[2p] What is the most common category of serious breach in real web applications? Two words.
What is the most common category of serious breach in real web applications? Two words.