SecurityInnovation/TMContentReview — Issue #7: Access Control Permissions Are Checked When Referencing Objects
Author: SergeTruth
Created: 2011-11-07 22:10:24+00:00
State: open

How to Check
You initially talk about direct object references then switch to indirect object references.

In this section can you go through an example. The guidance is a bit vague and could be clarified by highlighting a concrete example.

How to Fix
You initially talk about direct object references then switch to indirect object references.

To me an indirect object reference is one of the solutions to using direct object references.

For example instead of using the primary key values in URLs for example:

http://www.server.com/webApp/servlet?userId=111

use an indirect reference:

http://www.server.com/webApp/servlet?userId=AAA

and on the server AAA is mapped to 111

Using JAAS for Authorization is problematic because it requires using doPrivileged blocks. JAAS was developed with a specific set of requirements which usually are not required in most Web apps.