Web Application Security, 2nd Edition

Chapter 33. Defending Data and Objects

Despite being a target for various forms of attack, data and objects within application code are actually quite simple to defend. Outside of data storage in a database, most objects that programming languages interact with are stored either ephemerally (in-memory) or persistently (in-filesystem).

Because programming languages perform operations primarily in memory, most of the time when dealing with persistent file-stored data, the data is brought into memory for the duration of operations. Because of this, there are many cases where defenses that benefit ephemeral data will also benefit filesystem data.

Defending Against Mass Assignment

Mass assignment attacks are relatively easy to prevent provided consideration is given to security while programming a web application. Consider the following mass assignment vulnerability:

/*
 * This is a server-side API endpoint for updating player data
 * for the web-based video game "MegaGame".
*/
app.post("updatePlayerData", function(req, res, next) {
 // if client sent back player state data, update in the database
 if (!!req.body.data) {
   db.update(session.currentUser, req.body.data);
   return res.sendStatus(200); // success
 } else {
   return res.sendStatus(400); // error
 }
});

This vulnerability exists because the developer chose to trust the data sent by the client and update database fields based on an object that could be tampered via a malicious user.

There are two generally acceptable defenses against ...