token authentication security best practice

Question

So I'm trying a few token based authentication in Laravel, each user have token they can use to access certain database. But there is something I still don't understand from these tutorial. The tutorials seem to only check whether a user have token, if yes then authenticate the profile to do certain api call, but obviously this is not secure.

When let's say a user "Andrew" has his own token and say he can see his own profile (in a 'profile' table), he can also see other people's profile providing he have his own token, if he can guess the api call for that other profile. Let's say he simply seen the api call for his profile example.site/getprofile?id=22 and try changing the id to see other's profile, and he will be authenticated because he has token.

How do I make sure that he can't see other's profile? what is the best practice?

Answer 1

I would suggest the following for your specific example where its the user id that you are using for the query parameter

• In the token add a userid claim. (usually the token will already have one of these in some form or another, maybe the 'sub' claim?)

• Make the apicall 'getMyProfile' with zero parameters

• In the controller read the token claims and pull out the userid. use this to retrieve the users profile and return it.

If a general 'getProfile' method is required you can add this too, but use the tokens 'role' claims to limit access to admin (or whatever role is required) users

Answer 2

It seems you have authentication covered, but you should also look up some tutorials on authorisation as well, which is what you are describing.

Essentially, every security-sensitive action should perform an authorisation step to determine whether it is allowed before it is actually performed. I'm not sure of the Laravel specifics, but in the case of viewing a user profile, for example, the authorisation will check that the ID of the current user, which should be obtainable from their token somehow, is the same as the ID of the profile being viewed, or possibly whether the current user is an admin or super-user, and will not allow viewing if this is not the case.

Edit: It looks like Laravel has a whole authorisation framework included, so this page should help you get started with a Laravel-specific solution.