spikerj/spikersoft-issues
1
0
Fork 0
Code Issues 196 Pull Requests Actions Packages Projects Releases Wiki Activity

[Security][Blog][Record] Create endpoints accepted spoofable client-supplied AuthorId — fixed by backend #423 (epic #705) #716

New Issue
Closed
opened 2026-07-19 01:15:58 +00:00 by spikerj · 1 comment
spikerj commented 2026-07-19 01:15:58 +00:00
Owner
Copy Link
Copy Source

Epic #705. Record ticket for traceability (every merged fix traces to a closed issue): POST /api/blog/posts and /posts/upload had no [Authorize] and took AuthorId from the client DTO — spoofable authorship, which was the anchor of the owner-only delete check AND (via the profile-missing fallback) could steer media into another user's /app/blogs/<username>/ directory.

Fixed in spikersoft-backend PR #423: [Authorize] on both endpoints + AuthorId derived server-side from the Keycloak sub claim; 4 new tests. Close this once #423 merges.

Remaining same-class holes tracked separately: comment endpoints (#707), update endpoint (#709).

Epic #705. Record ticket for traceability (every merged fix traces to a closed issue): `POST /api/blog/posts` and `/posts/upload` had no `[Authorize]` and took `AuthorId` from the client DTO — spoofable authorship, which was the anchor of the owner-only delete check AND (via the profile-missing fallback) could steer media into another user's `/app/blogs/<username>/` directory. **Fixed in spikersoft-backend PR #423**: `[Authorize]` on both endpoints + `AuthorId` derived server-side from the Keycloak `sub` claim; 4 new tests. Close this once #423 merges. Remaining same-class holes tracked separately: comment endpoints (#707), update endpoint (#709).
spikerj commented 2026-07-22 02:44:54 +00:00
Author
Owner
Copy Link
Copy Source

Verified fixed and on master. BlogController create now anchors authorship to the caller's Keycloak identity server-side and ignores the client-supplied AuthorId (in-code comment: "it was spoofable"); command = new CreateBlogPostCommand { … AuthorId = callerId }. Commit f4ac2418 ("feat(blog): anchor create authorship to the caller's Keycloak identity") is an ancestor of origin/master and added BlogControllerTests regression coverage. Deployed/live. Closing.

Verified fixed and on `master`. `BlogController` create now anchors authorship to the caller's Keycloak identity server-side and **ignores** the client-supplied `AuthorId` (in-code comment: "it was spoofable"); `command = new CreateBlogPostCommand { … AuthorId = callerId }`. Commit `f4ac2418` ("feat(blog): anchor create authorship to the caller's Keycloak identity") is an ancestor of `origin/master` and added `BlogControllerTests` regression coverage. Deployed/live. Closing.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
agentic
Actionable surfaced by the agentic architecture & security review
 bug
Something is not working
 duplicate
This issue or pull request already exists
 enhancement
New feature
 help wanted
Need some help
 invalid
Something is wrong
 question
More information is needed
 sonarqube
Code quality issue surfaced by SonarQube (bug / code smell)
 wontfix
This won't be fixed
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
spikerj (Joseph Spiker)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: spikerj/spikersoft-issues#716