Practically every web application is supposed to have multiple users and each user has some data – posts, documents, messages, whatever. And the most obvious thing to do is to protect these entities from being obtained by users that are not the rightful owners of these resources.
Unfortunately, this is not the easiest thing to do. I don’t mean it’s hard, it’s just not as intuitive as simply returning the resources. When you are your /record/{recordId} endpoint, a database query for the recordId is the immediate thing you do. Only then comes the concern of checking whether this record belongs to the currently authenticated user.
Frameworks don’t give you a hand here, because this access control and ownership logic is domain-specific. There’s no obvious generic way to define the ownership. It depends on the entity model and the relationships between entities. In some cases it can be pretty complex, involving a lookup in a join table (for many-to-many relationships).
But you should automate this, for two reasons. First, manually doing these checks on every endpoint/controller method is tedious and makes the code ugly. Second, it’s easier to forget to add these checks, especially if there are new developers.
You can do these checks in several places, all the way to the DAO, but in general you should fail as early as possible, so these checks should be on a controller (endpoint handler) level. In the case of Java and Spring, you can use annotations and a HandlerInterceptor to automate this. In case of any other language or framework, there are similar approaches available – some pluggable way to describe the ownership relationship to be checked.
Below is an example annotation to put on each controller method:
public @interface VerifyEntityOwnership {
String entityIdParam() default "id";
Class<?> entityType();
}Then you define the interceptor (which, of course, should be configured to be executed)
@Component
public class VerifyEntityOwnershipInterceptor extends HandlerInterceptorAdapter {
private static final Logger logger = LoggerFactory.getLogger(VerifyEntityOwnershipInterceptor.class);
@Autowired
private OrganizationService organizationService;
@Autowired
private MessageService MessageService;
@Autowired
private UserService userService;
@Override
public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) {
Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
// assuming spring-security with a custom authentication token type
if (authentication instanceof ApiAuthenticationToken) {
AuthenticationData authenticationData = ((ApiAuthenticationToken) authentication).getAuthenticationData();
UUID clientId = authenticationData.getClientId();
HandlerMethod handlerMethod = (HandlerMethod) handler;
VerifyEntityOwnership annotation = handlerMethod.getMethodAnnotation(VerifyEntityOwnership.class);
if (annotation == null) {
logger.warn("No VerifyEntityOwnership annotation found on method {}", handlerMethod.getMethod().getName());
return true;
}
String entityId = getParam(request, annotation.entityIdParam());
if (entityId != null) {
if (annotation.entityType() == User.class) {
User user = userService.get(entityId);
if (!user.getClientId().equals(clientId)) {
return false;
}
} else if (annotation.entityType() == Message.class) {
Message record = messageService.get(entityId);
if (!message.getClientId().equals(clientId) {
return false;
}
} // .... more
}
}
return true;
}
@SuppressWarnings("unchecked")
private String getParam(HttpServletRequest request, String paramName) {
String value = request.getParameter(paramName);
if (value != null) {
return value;
}
Map<String, String> pathVariables = (Map<String, String>) request.getAttribute(HandlerMapping.URI_TEMPLATE_VARIABLES_ATTRIBUTE);
return pathVariables.get(paramName);
}
}You see that this presumes the need for custom logic per type. If your model is simple, you can make that generic – make all your entities implement some `Owned interface with getClientId() method that all of them define. Then simply have a dao.get(id, entityClass); and avoid having entity-specific logic.
Notice the warning that gets printed when there is no annotation on a method – this is there to indicate that you might have forgotten to add one. Some endpoints may not require ownership check – for them you can have a special @IgnoreEntityOwnership annotation. The point is to make a conscious decision to not verify the ownership, rather than to forget about it and introduce a security issue.
What I’m saying might be obvious. But I’ve seen many examples of this omission, including production government projects. And as I said, frameworks don’t force you to consider that aspect, because they can’t do it in a generic way – web frameworks are usually not concerned with your entity model, and your ORM is not concerned with your controllers. There are comprehensive frameworks that handle all of these aspects, but even they don’t have generic mechanisms for that (at least not that I’m aware of).
Security includes applying a set of good practices and principles to a system. But it also includes procedures and automations that help developers and admins in not omitting something that they are generally aware of, but happen to forget every now and then. And the less tedious a security principle is to apply, the more likely it will be consistently applied.
| Published on Java Code Geeks with permission by Bozhidar Bozhanov, partner at our JCG program. See the original article here: Automate Access Control for User-Specific Entities Opinions expressed by Java Code Geeks contributors are their own. |
