Insecure object reference - Personal information - Elixir

Need

Prevent unauthorized modification of other user's information

Context

1. Usage of Elixir (version 1.12 and above) for building scalable and fault-tolerant applications
2. Usage of Phoenix Framework for building web applications
3. Usage of Plug for session handling
4. Usage of Ecto for data persistence

Description

Insecure Code Example

defmodule UserController do
  def update(conn, %{'id' => id, 'user' => user_params}) do
    user = Repo.get(User, id)
    changeset = User.changeset(user, user_params)
    Repo.update(changeset)
  end
end

The code below is insecure because it uses the user_id from the request parameters to fetch and update a user. An attacker can change the user_id parameter to update another user's information.

Steps

1. Store the authenticated user's id in the session after successful login.
2. Instead of getting the user id from request parameters, get it from the session.
3. Use the user id from the session to fetch and update the user.

Secure Code Example

defmodule UserController do
  def update(conn, %{'user' => user_params}) do
    id = get_session(conn, :user_id)
    user = Repo.get(User, id)
    changeset = User.changeset(user, user_params)
    Repo.update(changeset)
  end
end

The code below is secure because it uses the user_id stored in the session to fetch and update the user. Even if an attacker changes the user_id in the request parameters, it won't affect which user is updated because the user_id in the session is used.

References

Last updated

2023/09/18