Securing Account Parameters

Welcome to the very first lesson of the broken access control course! In this lesson, we will explore the critical topic of unverified account parameters in API endpoints. This vulnerability is a common entry point for attackers seeking unauthorized access to sensitive data.

By understanding how these vulnerabilities occur and learning how to secure your code, you'll be taking a significant step toward building more secure web applications. Let's dive in! 🚀

When building API endpoints that handle user data, it's crucial to implement proper access controls. Without proper verification, attackers can manipulate request parameters to access data belonging to other users. This is particularly dangerous when dealing with account information, as it can lead to unauthorized access to user data.

In this lesson, we'll focus on how unverified parameters can lead to unauthorized access vulnerabilities and the importance of securing these parameters to protect your application.

Let's take a look at a code snippet that demonstrates a vulnerable API endpoint using unverified parameters. This example will help us understand the risks associated with such vulnerabilities.

@RestController
@RequestMapping("/api/account")
public class AccountController {
    private final UserRepository users;

    public AccountController(UserRepository users) {
        this.users = users;
    }
    
    @GetMapping("/accountInfo")
    public ResponseEntity<?> accountInfo(@RequestParam(name = "id", required = false) String id) {
        // Check if the id parameter is provided
        if (id == null || id.isBlank()) {
            return ResponseEntity.status(HttpStatus.BAD_REQUEST)
                .body(new ErrorResponse("Missing user ID parameter"));
        }
        
        // Parse the id parameter to an integer
        Integer userId;
        try {
            userId = Integer.parseInt(id);
        } catch (NumberFormatException e) {
            return ResponseEntity.status(HttpStatus.BAD_REQUEST)
                .body(new ErrorResponse("Invalid user ID"));
        }
        
        // VULNERABILITY: No authentication or authorization check!
        // Any user can access any account by changing the id parameter
        return users.findById(userId)
            .<ResponseEntity<?>>map(ResponseEntity::ok)
            .orElseGet(() -> ResponseEntity.status(HttpStatus.NOT_FOUND)
                .body(new ErrorResponse("User not found")));
    }
}

In this code, the id parameter is taken directly from the query string using @RequestParam and is used to fetch user data without any verification. This lack of validation allows an attacker to manipulate the id parameter to access any user's account details, leading to unauthorized data access.

Note: This is a classic example of Insecure Direct Object Reference (IDOR). The application trusts the user-supplied id without verifying if the authenticated user has the right to access that specific resource.