0

I'm developing a service in node JS that will act as a middleware for a client calling a third party API.

My service will make some security and user roles checks before calling the third party.

So when I call my service it looks like this https://myservice/:param1/:thirdPartyURL

I use the param1 to make some security checks.

So my question is, is it ok to pass the desired thirdPartyURL as a parameter so I can make the call after the security checks pass?

I'm wondering if this is a common practice and if my implementation would be insecure.

1
  • Can you pass an object that is a securedURL that only comes from the security check?
    – JeffO
    Apr 10, 2018 at 1:32

1 Answer 1

2

First, you need to decide, overall, whether you wish to treat the client application as "trusted." If you are not sure, you should treat it as untrusted. It's not personal; this doesn't mean you think the folks running that system are not trustworthy. It simply means that you wish to contain the risk, e.g. you do not believe they have the same level of access control or protection against malicious users that your systems have, they are not certified to the same level you are (in which case you are probably obligated to treat them as untrusted), or you simply want to reduce the attack surface for potential hackers. This is a key architectural decision that will drive a lot of other things, for example how you do penetration testing.

Once you have decided which system components are trusted and which ones are untrusted, you should ensure that all of the systems under your control validate every single piece of data that comes from an untrusted source, preferably against a white list. So if you have a list of possible URLs that are allowed, and you can validate against it, then yes, you can allow them to pass the URL, so long as you validate it. If you can't come up with a white list, it may be acceptable to use a regular expression or a proven code library to scan the URL for dangerous sequences. If you can do neither, it may not be a great idea to allow that URL to pass through.

If there is some way to represent the URL some other way-- for example, if there are ten possibly URLs and the client can just pass a number between 1 and 10 that indicates which URL they want-- that would avoid this whole issue completely.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.