Unverified Account Parameter in API Endpoints

Introduction

Welcome to the very first lesson of the "Broken Access Control" course! In this lesson, we will explore the critical topic of unverified account parameters in API endpoints. This vulnerability is a common entry point for attackers seeking unauthorized access to sensitive data. By understanding how these vulnerabilities occur and learning how to secure your code, you'll be taking a significant step toward building more secure web applications. Let's dive in! 🚀

Understanding Unauthorized Access via Parameter Manipulation

When building API endpoints that handle user data, it's crucial to implement proper access controls. Without proper verification, attackers can manipulate request parameters to access data belonging to other users. This is particularly dangerous when dealing with account information, as it can lead to unauthorized access to user data. In this lesson, we'll focus on how unverified parameters can lead to unauthorized access vulnerabilities and the importance of securing these parameters to protect your application.

Vulnerable Code Example

Let's take a look at a code snippet that demonstrates a vulnerable API endpoint using unverified parameters. This example will help us understand the risks associated with such vulnerabilities. TypeScript router.get('/accountInfo', async (req, res) => {const userId = req.query.id; if (!userId) {return res.status(400).json({ error: "Missing user ID parameter" });} const user = await User.findByPk(userId); if (!user) {return res.status(404).json({ error: "User not found" });} res.json(user);}); In this code, the userId parameter is taken directly from the query string and used to fetch user data without any verification. This lack of validation allows an attacker to manipulate the id parameter to access any user's account details, leading to unauthorized data access.

Exploiting the Vulnerability

An attacker can easily exploit this vulnerability by manipulating the URL parameters. Here is an example of how this can be done using a simple curl request: Shell curl "http://localhost/api/accountInfo?id=1" By sending this request, an attacker can access the account information of the user with id=1, which could be an admin or any other user. This demonstrates how easily unverified parameters can be exploited to gain unauthorized access to sensitive data.

Join the 1M+ learners on CodeSignal

Be a part of our community of 1M+ users who develop and demonstrate their skills on CodeSignal

Authentication Checks

The first line of defense is proper authentication. We need to ensure that only authenticated users can access account information. We'll use JSON Web Tokens (JWT) for authentication. JWT is a compact, URL-safe means of representing claims between two parties. It consists of three parts: a header, a payload, and a signature. When a user logs in, they receive a JWT that they must include in subsequent requests to prove their identity.

The JWT_SECRET_KEY is a private key used to sign and verify tokens. It should be kept secure and never exposed to the public, as anyone with access to this key could forge valid tokens.

TypeScript

router.get('/accountInfo', (req, res) => {
  const authHeader = req.headers['authorization'];
  const token = authHeader && authHeader.split(' ')[1];
  
  if (!token) {
    return res.status(401).json({ error: "Authentication required" });
  }

  try {
    const decoded = jwt.verify(token, JWT_SECRET_KEY) as { userId: number };
    req.user = { id: decoded.userId };
  } catch (err) {
    return res.status(401).json({ error: "Invalid token" });
  }
});

router.get('/accountInfo', (req, res) => {
  const authHeader = req.headers['authorization'];
  const token = authHeader && authHeader.split(' ')[1];
  
  if (!token) {
    return res.status(401).json({ error: "Authentication required" });
  }

  try {
    const decoded = jwt.verify(token, JWT_SECRET_KEY) as { userId: number };
    req.user = { id: decoded.userId };
  } catch (err) {
    return res.status(401).json({ error: "Invalid token" });
  }
});

Here, we extract the JWT token from the Authorization header and verify it using our secret key. The code first checks if the token exists, and if not, returns a 401 error. If the token is present, we attempt to verify it using jwt.verify(). Upon successful verification, we extract the user's ID from the decoded token and attach it to the request object for later use. If the token is invalid or expired, a 401 error is returned.

This authentication layer ensures that only users with valid tokens can proceed to access protected endpoints.