What are the best practices to authorize every REST request?

Question

My question may sound very naïve to someone, but it is what it is.

I have below scenario:

• Relational MySQL Database with BIGINT primary keys and foreign keys
• Spring boot as a backend (technology doesn't matter here)
• Angular as a frontend (again technology doesn't matter)

This system is a large system and there are many intermingled modules with foreign key references, lookup tables, etc. and all the users must be authenticated (we have Spring Security OAuth) to access this system. So from authentication view-point, we are safe. Also we are managing roles and permissions for user's actions (they are mostly used on UI to hide/show menus, buttons, and actions). Everything good so far. The real challenge arises here - lets say there is some ABC module, and authenticated user X is accessing its information using REST call /api/abc/1, here 1 is the primary key of ABC, and ABC data with key 1 belongs to X only. But as you can see here, changing the id in above URL, user can access ABC module data of other users too. So how can these actions be authorized?

Below are the points of my research, but none of them seem viable:

• Use UUID instead of Int primary keys. But there are drawbacks of UUIds that they increases the database size and they are also guessable at some point by bots.
• Do not expose the primary keys. But this case will not work in my scenario, as I told that there are many intermingled modules with many references. And in many of the modules, primary keys are the one which are unique.
• Intercept every REST call, and check whether the passed id/ids belong to that particular authenticated user. But this solution will also become clumsy after some extends because there are many modules, and it will also increase the number of queries to database.

So what is the best way for authorization in this kind of application?

NOTE: This question is not related to any of the technology or implementation, but just related to Security design of REST APIs.

Answer 1

You need to implement number 3:

Intercept every REST call, and check whether the passed id/ids belong to that particular authenticated user. But this solution will also become clumsy after some extends because there are many modules, and it will also increase the number of queries to database.

Since you only have one RDBM to query against it seems like a totally easy and in-expensive join on the users or permissions table.

You always need a WHERE on your SQL statement to determine whether the user "owns" the data or not.

Answer 2

Like @DanielFrost, I too would tend to recommend 3, but there are some other options

1. Implement row-level security on your database. This may or may not be feasible depending on how decoupled your API, DB, authentication mechanism is and what products you are using.

2. Encrypt the IDs on the way out using the user ID (or proxy) + session salt, essentially rendering them opaque and unique to a user + session. Decrypt them back to native when they are submitted in the API URL.

The advantage of #2 is that you don't have to do all the joins, though you still have to do some work on each endpoint that needs the ID.