Risk of exposing an ID of entry in DRF framework

user_13147315 0
Viewed 270

I'm building an API and I've started using the GenericAPIViews. In this example

class InsertActivityChange(UpdateAPIView):
    authentication_classes = []
    permission_classes = []
    serializer_class = ActivitiesSerializer
    lookup_field = 'id'

    def get_queryset(self):
        return Activities.objects.filter(id=self.kwargs['id'])
        
    def put(self, request, *args, **kwargs):
        return self.update(request, *args, **kwargs)

path('insertactivitychange/<int:id>', views.InsertActivityChange.as_view(), name='insertactivitychange'),

I've used a generic class to do updates for an object. My concern is if I'm risking much by allowing the ID to be directly inputted after the URL. Obviously, I'd further mitigate the risk by properly configuring the authentication and permission class, so is the ID of the entry even a security risk?

django-rest-framework django python
2 Answers

Let me try to answer this question.

One can't ensure security just by hiding things

One of my mentor always emphasized on this line whenever I had asked similar questions.

To answer you question, according to me no you don't expose any security flaws by exposing IDs, in fact it's one of the most common way of allowing users to interact with resources over APIs.

You will be surely required to have authentication and authorisation in place to safeguard the resource manipulation by malicious sources. In context of DRF and django you can achieve this by using authentication and permissions.

Hope this answers your question.

user_67662090

If you're worried about access, remember to add permissions and filters. If you're focused on security and hiding resources, make sure they will 404 instead of 401 or 403. Have a look at DRF filtering section and in serializers use PrimaryKeyRelatedField queryset where you filter based on user.

If you're worried about exposing pks, just use UUIDs. It will still be visible but a human can't predict what the next id is.

So even if 3rd party knows the id of a resource, it should return 404 if you want to hide a resource. That way you expose a meaningless value to the attacker.

user_58334290
Related