Need

Implementation of proper authorization control for web services

Context

• Usage of Dart for building cross-platform mobile, web, and desktop applications
• Usage of Shelf for managing and organizing data in a Node.js application

Description

Non compliant code

        import 'package:shelf/shelf.dart' as shelf;

shelf.Response handleRequest(shelf.Request request) {
  // missing authorization control
  return shelf.Response.ok('Request processed successfully');
}

void main() {
  var handler = const shelf.Pipeline().addMiddleware(shelf.logRequests())
      .addHandler(handleRequest);

  io.serve(handler, 'localhost', 8080).then((server) {
    print('Serving at http://${server.address.host}:${server.port}');
  });
}
        
        

This Dart code is an example of a server that uses the Shelf framework. The server listens on localhost:8080 and logs all incoming requests.

The vulnerability lies in the handleRequest function. This function is supposed to handle all incoming requests, but it lacks any form of authorization control. Any request that comes in, regardless of its origin or intent, is processed and receives an OK response.

This means that anyone, including potential attackers, can send requests to this server and have them processed without any checks. This could lead to unauthorized access to sensitive data or malicious actions being performed on the server.

The server should have an authorization mechanism in place to verify the identity of the request sender and determine if they have the necessary permissions to perform the requested action. Without this, the server is open to a wide range of potential security threats.

Steps

• Introduce an authorization middleware in the pipeline that checks for valid credentials or tokens in the request headers.
• The middleware should reject requests that do not contain valid credentials or tokens with an appropriate HTTP status code such as 401 Unauthorized.
• Ensure that the authorization middleware is added before the request handler in the pipeline so that it is executed first.
• Consider using a library or framework that provides built-in support for authorization to avoid potential implementation errors.
• Regularly update and patch the authorization library or framework to protect against known vulnerabilities.
• Test the authorization control mechanism thoroughly to ensure it cannot be bypassed.

Compliant code

        import 'package:shelf/shelf.dart' as shelf;

shelf.Response authMiddleware(shelf.Request request) {
  final hasValidToken = request.headers['authorization'] == 'valid_token';
  if (!hasValidToken) {
    return shelf.Response.forbidden('Unauthorized');
  }
  return null;
}

shelf.Response handleRequest(shelf.Request request) {
  return shelf.Response.ok('Request processed successfully');
}

void main() {
  var handler = const shelf.Pipeline()
      .addMiddleware(shelf.logRequests())
      .addMiddleware(authMiddleware)
      .addHandler(handleRequest);

  io.serve(handler, 'localhost', 8080).then((server) {
    print('Serving at http://${server.address.host}:${server.port}');
  });
}
        
        

The code above introduces an authorization middleware in the pipeline that checks for valid tokens in the request headers. The authMiddleware function checks if the 'authorization' header of the request is equal to 'valid_token'. If the token is not valid, it returns a 403 Forbidden response, rejecting the request.

This middleware is added to the pipeline before the request handler using the addMiddleware method. This ensures that the authorization check is performed before any request is processed.

Please note that this is a simple implementation and in a real-world scenario, you would likely need to implement a more sophisticated authorization mechanism. For example, you might need to check the token against a list of valid tokens stored in a database, or use a library that provides built-in support for authorization.

Remember to regularly update and patch any libraries or frameworks you use to protect against known vulnerabilities. Also, make sure to thoroughly test your authorization control mechanism to ensure it cannot be bypassed.

References

• 039. Improper authorization control for web services