My question may sound very naïve to someone, but it is what it is.
I have below scenario:
- Relational MySQL Database with
BIGINTprimary keys and foreign keys
- Spring boot as a backend (technology doesn't matter here)
- Angular as a frontend (again technology doesn't matter)
This system is a large system and there are many intermingled modules with foreign key references, lookup tables, etc. and all the users must be authenticated (we have Spring Security OAuth) to access this system. So from authentication view-point, we are safe. Also we are managing roles and permissions for user's actions (they are mostly used on UI to hide/show menus, buttons, and actions). Everything good so far. The real challenge arises here - lets say there is some ABC module, and authenticated user X is accessing its information using REST call
1 is the primary key of ABC, and ABC data with key
1 belongs to X only. But as you can see here, changing the
id in above URL, user can access ABC module data of other users too. So how can these actions be authorized?
Below are the points of my research, but none of them seem viable:
- Use UUID instead of Int primary keys. But there are drawbacks of UUIds that they increases the database size and they are also guessable at some point by bots.
- Do not expose the primary keys. But this case will not work in my scenario, as I told that there are many intermingled modules with many references. And in many of the modules, primary keys are the one which are unique.
- Intercept every REST call, and check whether the passed
id/idsbelong to that particular authenticated user. But this solution will also become clumsy after some extends because there are many modules, and it will also increase the number of queries to database.
So what is the best way for authorization in this kind of application?
NOTE: This question is not related to any of the technology or implementation, but just related to Security design of REST APIs.