What is available for limiting the use of extend when using Breezejs, such users cant get access to sensitive data

Question

Basically this comes up as one of the related posts:

Isn't it dangerous to have query information in javascript using breezejs?

It was someone what my first question was about, but accepting the asnwers there, i really would appreciate if someone had examples or tutorials on how to limit the scope of whats visible to the client.

I started out with the Knockout/Breeze template and changed it for what i am doing. Sitting with a almost finished project with one concern. Security. I have authentication fixed and is working on authorization and trying to figure out how make sure people cant get something that was not intended for them to see.

I got the first layer fixed on the root model that a member can only see stuff he created or that is public. But a user may hax together a query using extend to fetch Object.Member.Identities. Meaning he get all the identities for public objects.

Are there any tutorials out there that could help me out limiting what the user may query.? Should i wrap the returned objects with a ObjectDto and when creating that i can verify that it do not include sensitive information?

Its nice that its up to me how i do it, but some tutorials would be nice with some pointers.

Code

controller

    public IQueryable<Project> Projects()
    {
      

        //var q = Request.GetQueryNameValuePairs().FirstOrDefault(k=>k.Key.ToLower()=="$expand").Value;
       // if (!ClaimsAuthorization.CheckAccess("Projects", q))
          //  throw new WebException("HET");// UnauthorizedAccessException("You requested something you do not have permission too");// HttpResponseException(HttpStatusCode.MethodNotAllowed);

        return _repository.Projects;
    }

_repository

    public DbQuery<Project> Projects
    {
        get
        {
           
            var memberid = User.FindFirst("MemberId");
            if (memberid == null)
                return (DbQuery<Project>)(Context.Projects.Where(p=>p.IsPublic));

            var id =  int.Parse(memberid.Value);
            return ((DbQuery<Project>)Context.Projects.Where(p => p.CreatedByMemberId == id || p.IsPublic));
        }
    }

Ward · Accepted Answer · 2013-05-22T09:10:12.327

Look at applying the Web API's [Queryable(AllowedQueryOptions=...)] attribute to the method or doing some equivalent restrictive operation. If you do this a lot, you can subclass QueryableAttribute to suit your needs. See the Web API documentation covering these scenarios.

It's pretty easy to close down the options available on one or all of your controller's query methods.

Remember also that you have access to the request query string from inside your action method. You can check quickly for "$expand" and "$select" and throw your own exception. It's not that much more difficult to block an expand for known navigation paths (you can create white and black lists). Finally, as a last line of defense, you can filter for types, properties, and values with a Web API action filter or by customizing the JSON formatter.

The larger question of using authorization in data hiding/filtering is something we'll be talking about soon. The short of it is: "Where you're really worried, use DTOs".

What is available for limiting the use of extend when using Breezejs, such users cant get access to sensitive data

Code

1 Answers1