bug(blog): comment endpoints are anonymous and comment author identity is client-spoofable #748

New Issue

2026-07-20T19:58:31Z

spikerj commented

2026-07-20 19:58:31 +00:00

Follow-up from #745. POST api/blog/posts/{id}/comments and POST api/blog/posts/{postId}/media/{mediaId}/comments have no [Authorize], and the comment author comes entirely from the request body — the frontend literally sends authorId: "current-user-id", authorName: "Current User", and any caller can post comments as anyone (or as nobody) on a kids' platform.

Fix

Backend (spikersoft-backend):

[Authorize] on both comment endpoints.
Server-anchor identity exactly like blog create-time provenance: ignore client-supplied authorId/authorName; stamp the comment with the caller's Keycloak sub + display name from claims in the handler.

Frontend (spikersoft-angular):

Stop sending the fake authorId/authorName (server ignores them now); send content only.
Hide/disable the comment inputs for anonymous viewers (the blog route is anonymous-viewable, so today logged-out users see comment boxes that would 401).

Repos: spikersoft-backend, spikersoft-angular

Follow-up from #745. `POST api/blog/posts/{id}/comments` and `POST api/blog/posts/{postId}/media/{mediaId}/comments` have no `[Authorize]`, and the comment author comes entirely from the request body — the frontend literally sends `authorId: "current-user-id", authorName: "Current User"`, and any caller can post comments as anyone (or as nobody) on a kids' platform. ## Fix Backend (spikersoft-backend): - `[Authorize]` on both comment endpoints. - Server-anchor identity exactly like blog create-time provenance: ignore client-supplied `authorId`/`authorName`; stamp the comment with the caller's Keycloak sub + display name from claims in the handler. Frontend (spikersoft-angular): - Stop sending the fake authorId/authorName (server ignores them now); send content only. - Hide/disable the comment inputs for anonymous viewers (the blog route is anonymous-viewable, so today logged-out users see comment boxes that would 401). Repos: spikersoft-backend, spikersoft-angular

spikerj commented

2026-07-20 20:11:46 +00:00

Resolved and merged:

spikersoft-backend PR #437 (merged to master, 5139211a): [Authorize] on both comment endpoints; comments are stamped with the caller's Keycloak sub + claim-derived display name — the DTO's authorId/authorName are ignored (kept optional so older clients don't 400).
spikersoft-angular PR #477 (merged to master, 0d1f269b): comment calls send content only (no more hardcoded "current-user-id"), and comment inputs are hidden for anonymous viewers; existing comments remain readable.

Closing.

Resolved and merged: - **spikersoft-backend PR #437** (merged to master, `5139211a`): `[Authorize]` on both comment endpoints; comments are stamped with the caller's Keycloak sub + claim-derived display name — the DTO's `authorId`/`authorName` are ignored (kept optional so older clients don't 400). - **spikersoft-angular PR #477** (merged to master, `0d1f269b`): comment calls send content only (no more hardcoded "current-user-id"), and comment inputs are hidden for anonymous viewers; existing comments remain readable. Closing.

spikerj closed this issue

2026-07-20 20:11:46 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: spikerj/spikersoft-issues#748