I'm creating a MERN full stack app and trying to get my head around authorization and authentication. If I was just to include authentication on the login page (ie. a function that checks if the user and password provided matches that of the database) and then allow the user access to all of their information (let's say blog posts) and all of CRUD operations, could somebody give me a hypothetical example of how a hacker could access or perform some of these operations without authorization being imposed?
CodePudding user response：
After having successfully authenticated the first request (POST /login, say), how do you plan to authenticate the subsequent CRUD requests (GET /myaccountbalance, say)? You write "then allow the user access to all ...", but how do you plan to do that?
A well-established mechanism is to establish a session for the user on the server after login and send a session cookie back to the browser, which will then include that session cookie in all subsequent requests. Your server need only validate that a session exists before executing a CRUD request. The cookie thus acts like a session-specific password, and hackers definitively cannot obtain it via cross-site scripting if the cookie is httpOnly. But perhaps you knew that already.
Session handling in express is easy with express-session.
CodePudding user response：
Here are some examples, not all of which are completely preventable:
- User passwords might be guessable, or already leaked. This is why you have to enforce some complexity requirements, and maybe check against known leaked passwords from this API: https://haveibeenpwned.com/API/v3
- If you don't have a rate limiting / suspicious activity detection mechanism, logins might be brute-forced
- Depending on how your code is written, you might have forgot to check authentication on certain routes
- CSRF https://owasp.org/www-community/attacks/csrf
- Assuming you hash passwords, the login view might be subject to timing attacks (https://en.wikipedia.org/wiki/Timing_attack)
If you weren't using MongoDB, SQL injections would also be a thing to concider.