I'm building a paid feature for my application & the clients who haven't enabled it won't have access to it

While building all the API's around it, I see that I'm doing a lot of permission checks in every API (whether the feature is enabled for that client)

My question is, should I really bother?

The reason why I say so is because, my application is served through a UI and if the feature is disabled then the UI won't exist for it

The only reason why I added permission checks is because of the possibility of someone doing a curl

Am I over engineering it? I guess it depends on how critical the application is? What's the best practice here?

  • You are probably not engineering it enough. Hopefully you have some kind of overall access check on every interaction, why not put the level of access check where you validate that token by having a way to give the checker the category of access required for that endpoint. Mar 7 '19 at 13:20
  • Best practice is enforcing security checks at every level. While most of your legitimate clients won't know/care about your API, there are enough that might want to exploit it to get something for nothing. Since this is a paid feature, you would be throwing money away. Mar 7 '19 at 13:23

The first rule of any client-server application is that you never trust the client, ever.

You don't say how your UI is implemented, but most UIs can be trivially inspected to determine what exactly it is that they do. If the code that hides the paid feature is anywhere where a user could inspect it, they could find out about the feature. "Inspect" includes: using the browser's dev tools, trying URLs in the browser that look like they might do something, using a packet sniffer, decompiling the UI application, etc.

Also, if any user out there on the public internet can do a curl or whatever and invoke the thing, then you should assume that will actually happen. The input to your program from users is never random and you should never assume they won't find the thing because the don't bother to look.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.