3 ms·

“Configure applications to deny access by default and ensure the application performs authentication and authorization checks for every request to modify data,

“Configure applications to deny access by default and ensure the application performs authentication and authorization checks for every request to modify data, delete data, and access sensitive data." So why aren’t devs coding basic auth checks into every request? Is it something about the tooling? Maybe the way they structure auth and tokens? Are they worried about performance? Is it ignorance? Why would a company like Microsoft not know to wall off API requests to non-authenticated and logged-in accounts?

eddd-ddde 3y ago
At school, EVERY SINGLE project we did, there wasn't one instance of them doing authentication for objects, just get the id and return the data. I was even more surprised were at my first job they were doing the exact same. Mind you this was production software already with hundreds of user dealing with sensitive personal data. People just don't know what they are doing. The best part was their s3 bucket with all of user's data was completely public read because "if we make it private we cant display the pdfs on the web site".
sublinear 3y ago
> Are they worried about performance? Yes. You use a gateway to protect your service from unauthorized requests slowing everything down. A cluster of reverse proxies taking the impact of a denial of service attempt is exactly what you want. You also delegate the auth to another service so that attempts to log in and determining permissions does not slow down your core functionality. Auth headers and the identifier are passed from the internet user to the auth service via the proxy and it looks up the permissions on the given identifier for that user to confirm or deny the request. The API service on the backend doesn't necessarily need to know about any of this to be secure. It just needs to be walled off from everything that's not the gateway.

eddd-ddde 3y ago

At school, EVERY SINGLE project we did, there wasn't one instance of them doing authentication for objects, just get the id and return the data. I was even more surprised were at my first job they were doing the exact same. Mind you this was production software already with hundreds of user dealing with sensitive personal data. People just don't know what they are doing. The best part was their s3 bucket with all of user's data was completely public read because "if we make it private we cant display the pdfs on the web site".

sublinear 3y ago

> Are they worried about performance? Yes. You use a gateway to protect your service from unauthorized requests slowing everything down. A cluster of reverse proxies taking the impact of a denial of service attempt is exactly what you want. You also delegate the auth to another service so that attempts to log in and determining permissions does not slow down your core functionality. Auth headers and the identifier are passed from the internet user to the auth service via the proxy and it looks up the permissions on the given identifier for that user to confirm or deny the request. The API service on the backend doesn't necessarily need to know about any of this to be secure. It just needs to be walled off from everything that's not the gateway.