The discussion “Logical security over Current User actions” revolves around ensuring that user actions are secure and cannot be manipulated by tampering with the client-side JavaScript. feabila initially expressed concern that a user could manipulate their own username in the browser, potentially enabling unauthorized actions. However, merefield clarified that the server-side authentication token prevents such manipulation, and any changes made on the client-side are wiped out upon refreshing the browser.
feabila understood that the best approach is to always retrieve the current user session from the back-end server, rather than relying on the client-side PreloadStore. merefield further explained that persistent changes can only be made on the server, and the client-side EmberJS is only for user convenience.
feabila shared concerns about validating user actions based on the backend user session, specifically regarding post editing permissions. merefield advised that security measures should be developed on the back-end, using Rails serializers, the Guardian, and controllers to protect the server.
After analyzing plugin code, feabila discovered that even if the front-end is manipulated, the back-end server performs ultimate checks in the posts_controller.rb to ensure that only authorized users can edit posts. merefield commended feabila for digging deeper and understanding the security measures in place.
I have been doing some work around logical security based on current user information, like ´if this topic.creator.username to be equals to User.current().username´ I allow the user to edit topic or exclude!
So, the point is, I need to guarantee some actions based on User session! But I have been doing some tests, and that’s why I’m here now asking you.
Through Javascript in web browser (even in production mode), I’m capable of Discourse.User.current().set(‘username’, ‘sometestename’). This way, some actions in my system would be enabled just by this change. I know It’s not the goal of 99% of the users, but above this case, do you know guys some way to make sure user will not manipulate user information ?
If you change information in your local browser, that does not change anything on the back end.
The User is logged in via an authentication token, I believe, so you can’t masquerade as anyone else to the back-end:
Because there is no fooling the server, you will not be able to make any change as another user.
As soon as you refresh the browser, your local changes will probably be wiped out. Worst case you will probably mess up the javascript app state and have to delete your cache.
As you said, the best way so would be always get current user session from back-end server.
This way, cache changes from the browser couldn’t affect! Do you know somewhere I can check that logical security is based on user session from backend server, and not from PreloadStore ?
Warn me if i’m pointing out wrong way! Thank you Robert for help!
I’m no security expert, just an app dev, but all persistent changes can only be made on the server. What happens on the browser in EmberJS is for the user’s convenience and superior usability experience, eg. caching for speed, automagic app-like interface behaviour. It doesn’t change the fact that ultimately it has to negotiate all persistent changes with the Rails server, and in doing so will only have permission to do so for the logged in user.
Same goes for all data retrieval - the rails server is only going to send out data the logged in user is privy to.
I don’t think you need to worry about this, because if anyone were to try to subvert this, they would fall at the first hurdle: there is no way to fool the API.
I’m concerned because I’m working in some approaches which such action will be available or not depending on your User, if you are topic creator, if you are post creator, so this way I need to validate based on backend user session.
Like this, on post the user can edit it, if you are the post creator.
EDIT: Like the discourse post permissions, i will check it.
