TireSwingSoftware/openassign-server — Issue #113: Authorizer check method cache coherency issues
Author: jc0n
Created: 2012-02-28 23:03:05+00:00
State: open
Labels: behavior, security

In my recent work with the authorizer I have encountered some issues with check method cache coherency for checks that do not use the actee (and are decorated with `@does_not_use_actee`) but make use of other model objects, or relationships exposed through auth_token (ie. user). `actor_member_of_group` is a check that is particularly vulnerable. Currently, if a user was removed from a group the change would not take affect until the app was restarted. After my cache expiry changes in #112 it would not take affect until after the auth token expired which is better but not ideal.

I believe `actor_status_check` is vulnerable as well. This leaves only 3 very trivial methods to be cached which will likely introduce more overhead than just making the calls. `actor_is_anybody` simply returns True, the other two are just a wrapper around a call to isinstance, hardly worth caching.

My suggestion would be to remove check method result caching for now. I was pondering whether or not it would be possible to cache all of the authorizer methods based on a session_id and their parameters and then register notify callbacks for model object change signals that we could use to expire the cache. This would be relatively complicated to get right. Then I realized that type of caching is really a job for the ORM (which is likely caching a lot already). As far as the performance impact of the check methods, I think the best thing to do is optimize the individual methods that exhibit sub-optimal performance. I noticed a few that could be improved a lot just glancing through.