October 29, 2008 – 8:58 pm
Ever wondered about how to apply row-level security to your data? In other words, is the data for one of your customers/clients/accounts potentially right next to data for another customer? If so, your data may be exposed if your web pages use query string parameters or form data to run queries. For example, say you have a page that does this?
/pages/view.aspx?id=24
If so, what happens when someone manually types (or POSTs) a URL like so:
/pages/view.aspx?id=25
Do you even check that they have access? Is your method of checking cumbersome, subject to remembering to do it? Ever wish you had a way to force developers to check for access? Well, here’s a quick and easy method for doing just such a thing.
First, create an interface that each of your data objects will implement:
public interface ISecureDataObject
{
bool EnsureAccess(ref T owner);
}
Then, implement it in our Data class:
public class MyData : ISecureDataObject
{
public bool EnsureAccess(ref int accountId)
{
return this.AccountId == accountId;
}
}
Then, wherever you lookup the object, you can check to make sure they have access.
MyData m = sess.Get(myDataId);
m.EnsureAccess((int)Session["AccountId"]);
You can even enhance it more, so that an exception is automatically thrown.
public void EnsureAccess(object o, int accountId)
{
if (o is ISecureDataObject)
{
if (!((ISecureDataObject)o).EnsureAccess(ref accountId))
{
throw new DataAccessException("Your account (" + accountId + ") does not have access to this object. ");
}
}
else
{
throw new Exception("Programmer error - the object you are checking does not implement the requested security access method.");
}
}
Posted in Uncategorized | 1018 Comments »