Today I want to talk about a smell that I way sometimes on web application. We will start with a short story to create a context for our smell.
One day a request comes to the developer that he needs to create a page where the user can view a list of items. For each item the user can view details, edit an item and delete it. After a while the manager changes the request: “Only specific users can edit or delete items from the list”. Our developer based on the role of a user identifies what user can edit or delete items and for the rest of the user he decides to hide the two buttons.
When we look over the code something is wrong. If the user knows the URL for the edit page of an item or for deletion, he can edit and delete any items even if is not an admin.
We should never trust inputs that come from users. Every time we should validate on the server side the data from the user and also if he has rights to do execute a command or view a specific page.
In MVC application is very simple to do this. We only need to add an attribute to specific actions that we want to be access based on the user role. Another simple solution is to check if the user is part of a given role using the following method “Page.User.IsInRole(“RoleName”)”.
Be aware when you limit access of a user. For each access to a restricted area you should check the user rights. Don’t trust anything that the user sends to you.
One day a request comes to the developer that he needs to create a page where the user can view a list of items. For each item the user can view details, edit an item and delete it. After a while the manager changes the request: “Only specific users can edit or delete items from the list”. Our developer based on the role of a user identifies what user can edit or delete items and for the rest of the user he decides to hide the two buttons.
When we look over the code something is wrong. If the user knows the URL for the edit page of an item or for deletion, he can edit and delete any items even if is not an admin.
We should never trust inputs that come from users. Every time we should validate on the server side the data from the user and also if he has rights to do execute a command or view a specific page.
In MVC application is very simple to do this. We only need to add an attribute to specific actions that we want to be access based on the user role. Another simple solution is to check if the user is part of a given role using the following method “Page.User.IsInRole(“RoleName”)”.
Be aware when you limit access of a user. For each access to a restricted area you should check the user rights. Don’t trust anything that the user sends to you.
This is not a code smell, it's just plain weak software design.. :)
ReplyDeleteAuthorization for any real-world application should be designed upfront, not as an after-though, event if it's hard to get right.
This was not the first time when i saw this problem.
DeleteI look over the internet and in some places is marked as code smell. I will update the title, thank you.
+1
Delete