web program URL and User security

web program.
Requirement :
Staff 只能看到自己customer 之單.

staff S001 login admin page
/admin/ViewOrder?
list all order under this staff S001

/admin/ViewOrderDetails/R001

How to prevent other staff S002 view the R001 orderDetails?

Change to use post method?
但會唔會被修改 post method message parameter?

(other case if use webapi front end to backend)
即使用jwt token 都只能有分到, login and user.Role
post json 都會被佢改json post parameter?

咁請教下點搞, 避免被其他saff入都去睇R001 orderDetails?

0

0

freefdhk

進階會員

Rank: 3 Rank: 3 Rank: 3

2^#

發表於 2021-1-16 01:37 | 只看該作者

Login 時 Create 條Token 每次查詢傳佢用佢做對應。
如果係web 直頭行session 。

不過咁基本既野都煩惱睇怕你個system 搞好多勁多後門漏洞

TOP

antlee

進階會員

Rank: 3 Rank: 3 Rank: 3

3^#

發表於 2021-1-16 10:45 | 只看該作者

就當係"打電話問功課"...
>>即使用jwt token 都只能有分到, login and user.Role
->咁個token有無S001嘅user id(or equivalent)先
如有, 個問題實際係authentication/authorization問題
/admin/ViewOrder? -> list all order under this staff S001
1. check user(e.g. S001) 有無 rights/authorization 用呢個 resource? (by code/auth lib annotations)
2. filter orders accessible by S001 (by customer/order relations to S001)
/admin/ViewOrderDetails/R001 ->
How to prevent other staff S002 view the R001 orderDetails?
->check user(e.g. S002) 有無 rights/authorization 用呢個 resource

TOP

staymen

中級會員

Rank: 2 Rank: 2

4^#

發表於 2021-1-17 00:41 | 只看該作者

回覆 3# antlee

->check user(e.g. S002) 有無 rights/authorization 用呢個 resource

這個意思是否? 每次backend 到check
每次都要Database check ,  orderDetails ID 係唔係 ,under the staff S001?

webapi
getOrderDetails(OrderID){
getStaffIDFromToken                   --info. in token can not be modified
if(checkOrderUnderStaffID){       --common func. to check staff have right to access the order
      return orderDetails
}else{
         //error
}
}

TOP

antlee