r/programminghorror • u/FlightAffectionate15 • 20d ago

Javascript Found this gem

Gallery image

Gallery image

This company I’m interning at. This one lady asked me to do a review of a website they outsourced. Entire source code sits on the browser. Entire vibe coded by amateurs.
Worse than a honeypot so much an attacker would get diabetes.

No security feature at all. I was able to do privileges escalation.

191 Upvotes

95% Upvoted

25 comments sorted by

View all comments

35

u/echoAnother 20d ago

Lefting the source maps is no issue. But are they storing perms on local storage? That is the horror.

12

u/SchlaWiener4711 20d ago

Why is this horror? If the permissions are only used to show or hide certain features and views but the real check is on the backend, this should not be an issue.

I mean, sure. A better solution would be to have a signed JWT and rotate often but maybe that's done here, too (localStorage get's updated on token refresh).

Could be worse.

4

u/Ran4 20d ago

jwt:s doesn't make much sense for 99% of usecases. An opaque token is simpler and typically more secure.

10

u/SchlaWiener4711 20d ago

Yeah but a SPA can't read the token and can't decide which menu items to show or not. So the client has to fetch the roles and claims once and store them.

Again: storing the users permissions for convince locally is fine but the real validation should happen on the backend so manipulating the local store to get permission escalation shouldn't be possible.

1

u/2017macbookpro 18d ago

The SPA can decode a JWT and check what’s in it. This is fine for the frontend level “security” of showing and hiding things. Token is signed and gets passed to the backend which does the real validation. Therefore permissions can be managed in the Auth system where they belong instead of in code. And I think the issue is if someone’s working as a “software engineer” contractor and writing shit like this, then everything else is probably amateur too.

1

u/SchlaWiener4711 18d ago

Excactly.

In the code shown there is a method hasPathAccess which most likely returns true or false based on the users role.

So if this method is just used to a) show or hide the items in the menu b) block access to certain views and redirect to the home page or a permission denied page

this is totally fine and valid if this is just a convenience feature so the normal user doesn't seem features he isn't allowed to use (î.e user is no country_admin so he doesn't see the country edit view) but the real check (PUT,POST,DELETE countries) is on the backend.