3 ms·
Those who know me will laugh to see me continuing to beat this dead horse, but this is a really great example of why ORM+scaffolding is an anti-pattern, by whic
by seldo 14y ago
Those who know me will laugh to see me continuing to beat this dead horse, but this is a really great example of why ORM+scaffolding is an anti-pattern, by which I mean it seems like a good idea at first, but the costs outweigh the benefits.
It's absolutely true that you can use ORM and scaffolding patterns in a totally secure way. But the problem is that the defaults are insecure -- every table can be accessed, every record is available, every field can be edited, and the URLs for doing so are (deliberately) easily guessable.
One of the simplest and most fundamental rules of effective security is to close everything down by default and only open things up as required, after careful consideration. Scaffolding breaks that rule.
- angryasian 14y agoI think it has less to do with ORM and more to do with laziness. Its really one line in the controller, if loggedin user is not the user trying to edit redirect.
- gambler 14y agoIt's not just laziness. 99% of all framework tutorials I've seen out there completely ignores even basic authentication/authorization issues, which are universal to all real websites. This lack of attention to details is cultivated.
- movingahead 14y agoI guess they are using Rails. If they had only taken a few hours to go through a free tutorial like the one at railstutorial.org , they could have avoided this blunder.
- Evbn 14y agoWell the original Rails book had it: http://pragprog.com/book/rails4/agile-web-development-with-rails http://pragprog.com/book/rails4/agile-web-development-with-r...
- grey-area 14y agoOne of the simplest and most fundamental rules of effective security is to close everything down by default and only open things up as required, after careful consideration. Scaffolding breaks that rule. This is really an argument for building authentication and authorization into every app, rather than against scaffolding/ORMs. As rails doesn't have auth (of both kinds) built in, it doesn't really matter if they offer scaffolding or not - any editing url you make is going to be completely without protection unless you add it. The only thing you'd be adding by not having guessable urls without authentication/authorization is security through obscurity. So IMHO the lack of auth is really the issue here (and the thing that breaks the rule in your final sentence), rather than the guessable urls.
- nathan_long 14y ago>> One of the simplest and most fundamental rules of effective security is to close everything down by default and only open things up as required, after careful consideration. Which is why my Rails authorization library takes a whitelisting approach. https://github.com/nathanl/authority#default_methods https://github.com/nathanl/authority#default_methods
- oelmekki 14y agodisclaimer : I don't use scaffolding either Well, scaffolds are not suppose to totally avoid coding. They try to provide what you may write again and again, but you're supposed to take that as a basis, not a final product.
- elchief 14y agoFor those looking for secure tenant solutions: EclipseLink ORM http://wiki.eclipse.org/EclipseLink/Examples/JPA/Multitenant http://wiki.eclipse.org/EclipseLink/Examples/JPA/Multitenant PostgreSQL Veil add-on: http://veil.projects.postgresql.org/curdocs/index.html http://veil.projects.postgresql.org/curdocs/index.html Multi-tenant Data and MySQL (trigger + view method): http://blog.empowercampaigns.com/post/1044240481/multi-tenant-data-and-mysql http://blog.empowercampaigns.com/post/1044240481/multi-tenan... MSDN Multi-Tenant Data Architecture: http://msdn.microsoft.com/en-us/library/aa479086.aspx http://msdn.microsoft.com/en-us/library/aa479086.aspx