PRC007 — Object addressed by ID without authentication

What it catches

An operation anyone can call (no security requirement) whose path picks one object by an identifier: a path parameter whose last word is an identifier ({id}, {userId}, {order_id}, {uuid}, {uid}, {slug}, {sku}, {key}, {username}, {email}, {title}, …), or a single lowercase word ending in id ({userid}). {version}, {langCode}, {pageNumber} and other parameters that select something other than one object are not reported.

As with PRC006, marking the operation public does not silence it.

Why it matters

Broken object level authorization is the most common API vulnerability (OWASP API1). Without authentication, the server cannot ask "is this your object?", so anyone can try identifiers one after another (/orders/1, /orders/2, …) and read or change every object.

How to fix it

Require authentication, and check on the server that the caller may access the object it asks for. If the objects really are public (published articles), use identifiers that cannot be guessed (random UUIDs, slugs) and ignore the finding on that operation with x-procyon-ignore and the reason.

Procyon v0.2 will test this for real: with two test accounts, it checks that one cannot reach the other's objects.

How to ignore it

If the finding is fine on purpose, write an x-procyon-ignore on the operation, with the reason. The finding is still reported, under Ignored, and no longer fails the run. See ignoring a finding.

/reports/{id}:
  get:
    x-procyon-ignore:
      - rule: PRC007
        reason: "Report IDs are random UUIDs"

Examples

Reported:

/orders/{orderId}:
  get:
    security: []
    parameters:
      - name: orderId
        in: path
        required: true
        schema:
          type: string

Not reported: the same operation under a security requirement (its own or the spec's default).