Mailing-List: contact user-help@struts.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Struts Users Mailing List" <user@struts.apache.org>
Received-SPF: pass (nike.apache.org: domain of davelnewton@gmail.com
 designates 209.85.216.52 as permitted sender)
MIME-Version: 1.0
In-Reply-To: 
 <CAE_TDVjZFVthaY7uEKmdN-9iQa=iLe3kVJiGALT5pBt7g4cwdQ@mail.gmail.com>
References: 
 <CAE_TDVhaYjS6qq+umx+S5=fS_WDGkgvb+nE=7sLX9KG+8URAGQ@mail.gmail.com>
	<CABLGb9xZ5yTM2S5op7ysgBnMm3Z0y2Tt4rMTJPZFCt4O+9m0HQ@mail.gmail.com>
	<CAE_TDVjZFVthaY7uEKmdN-9iQa=iLe3kVJiGALT5pBt7g4cwdQ@mail.gmail.com>
Date: Sat, 30 Nov 2013 10:36:19 -0500
Message-ID: 
 <CADJJoV5cmi5BedehqN2RV_pe+LS+SvC4hBxHODFz_osSB7Dihw@mail.gmail.com>
Subject: Re: Concealing primary key in web application with struts 2 from
 security perspective?
From: Dave Newton <davelnewton@gmail.com>
To: Struts Users Mailing List <user@struts.apache.org>
Content-Type: multipart/alternative; boundary=047d7bdc13fe4ddfef04ec66b509

--047d7bdc13fe4ddfef04ec66b509
Content-Type: text/plain; charset=ISO-8859-1

I don't see how it could, since there are an essentially unlimited number
of back ends, authorization mechanisms, etc that would need to be accounted
for. Struts 2 is agnostic when it comes to basically everything but the web
layer.
 On Nov 30, 2013 3:40 AM, "Mohit Gupta" <motgupta@gmail.com> wrote:

> I agree its not a struts 2 issue. My intention of question is just to ask
> does struts 2 provide any kind of implementation off the shelf (some kind
> of interceptor or any other approach)to address this. Thanks in advance
>
>
> On Sat, Nov 30, 2013 at 12:16 PM, Paul Benedict <pbenedict@apache.org
> >wrote:
>
> > Exposing the primary key is not a security issue; you always have to key
> > off something. What you need is business logic that ensures that a user
> may
> > only access what he may. That's not a Struts issue; it's logic that you
> > need to add in your business services.
> >
> >
> > On Fri, Nov 29, 2013 at 11:24 PM, Mohit Gupta <motgupta@gmail.com>
> wrote:
> >
> > > When you have internet facing application , its important not to expose
> > > direct object reference on UI to protect security vulnerability(where
> > user
> > > can retrieve the unauthorized data by merely changing the primary key).
> > > When you are righting the application from scratch there are various
> ways
> > > you can handle it like :-
> > >
> > > 1)Handling at data layer where query has user id in where class. user
> id
> > > should be picked from session
> > >
> > > 2)Maintaining the map reference map at server side . Key can be some
> > number
> > > generated based on some algo and value will be primary key. Then expose
> > > that number on ui . On server side get the value against that key. Even
> > if
> > > user manipulate the number corresponding value wont be found and throw
> an
> > > error. Something like this.
> > >
> > > There will be other ways also.
> > >
> > > My question is there something of similar kind available in struts 2
> >  where
> > > you can annotate the any field with primary key and it does the step 2
> > for
> > > you or any other implementation to abstract primary key.  Any ideas?
> > >
> >
> >
> >
> > --
> > Cheers,
> > Paul
> >
>

--047d7bdc13fe4ddfef04ec66b509--