Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Adding authentication to user end points. List, GetUser, Count and Delete #166

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
Open

Adding authentication to user end points. List, GetUser, Count and Delete #166

wants to merge 3 commits into from

Conversation

ShanuWije
Copy link

As part of the master of information security bug bounty assignment have identified that these endpoints needs to be secured. Otherwise any one can view the list of users and get the count without even login in

Description

As part of the master of information security bug bounty assignment have identified that these endpoints needs to be secured. Otherwise any one can list the users and get the count without login in

Fixes # (issue)

Type of change

Security fix

@ShanuWije
Adding authentication to list and count methods
14a9f03 
As part of the master of information security bug bounty assignment have identified that these endpoints needs to be secured. Otherwise any one can list the users and get the count without login in
@ShanuWije ShanuWije changed the title Adding authentication to list and count methods Adding authentication to user list and count methods May 15, 2021
ShanuWije
ShanuWije commented May 15, 2021
View reviewed changes
Copy link
Author

@ShanuWije ShanuWije left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Needs to have a proper validation on the delete user end point. Otherwise anyone can delete any user, even a normal user can delete a admin user account

@ShanuWije
getUser by id endpoints needs to be authenticated since this can be u…
55527de 
…sed to enumerate all the users in the database without login in
@ShanuWije ShanuWije changed the title Adding authentication to user list and count methods Adding authentication to end points list, getUser, count and Delete May 15, 2021
@ShanuWije ShanuWije changed the title Adding authentication to end points list, getUser, count and Delete Adding authentication to user end points list, getUser, count and Delete May 15, 2021
@ShanuWije ShanuWije changed the title Adding authentication to user end points list, getUser, count and Delete Adding authentication to user end points. list, getUser, count and Delete May 15, 2021
@ShanuWije ShanuWije changed the title Adding authentication to user end points. list, getUser, count and Delete Adding authentication to user end points. List, GetUser, Count and Delete May 15, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@ShanuWije