Secure JPA binding in Play framework - security

Question

I have a page:
<input type="hidden" name="user.id" value="123" />
<input type="text" name="user.name" value="John" />
and an action:
public static void save(User user) {
user.save();
}
Play loads the user entity from database by the user.id parameter, binds HTTP parameters to the object and the action saves it.
That is ok for trusted user like admin but not trusted user can change HTTP parameters to:
?user.id=456&user.name=John
and thus edit a different entity.
I check whether user has changed the user.id by putting user.id also to the session and then I validate its equality. This works fine since session is signed and can't be modified but how can I check easily many entities on the page – e.g. when doing a bulk update? Or just do it application wide by default?
I don't want to put 20 ids to the session and then check each id if it is equal to HTTP parameter.
One solution came to my mind. I would put a signed id as a token to each entity and check it during binding. How would you implement this?

Answer 1

From what I understand what you want is authentication and authorization.
Authentication tells you who the user is and you can pHk answer to do that or use the secure module
If you want to manage authorization (what the user can do, in your case what object the user can update) I would recommend looking at the security-permissions module.
It is based on the secure module but the drools based rules give you all the flexibility you need.

Answer 2

I'll try to clarify my solution proposed at the end of my question which would solve it generally.
Each entity will have another field – a token – which is the entity id signed by the secure key. This token does not have to be stored in database but can be computed on the fly. When a edit page is rendered it includes the signed id in e.g. __at field:
<input type="hidden" name="user.id" value="123" />
<input type="hidden" name="user.__at" value="9e01f3c8...4ccba38b9" />
<input type="hidden" name="user.address.id" value="124" />
<input type="hidden" name="user.address.__at" value="83df099...4a276fc8" />
When these entities are being bound in controller it sings again the received id and compares it to the __at field. If these signed values are not same then it indicates the user has changed the id.
I am not an encryption expert and didn't look how Play session is signed but I guess it is similar. Do you think this mechanism could work?

Answer 3

You can use checkAuthenticity method in a controller to check the authenticity of the form submitted.
In your server code you also have to check that the user as the rights to update theses entities. This can be done by adding a join to the user table in your jpa queries so you select not only on the object id but also on the user connected

Answer 4

You'll have to make sure that save can only be called by authenticated users. One way Play! allows you to do this is by using the #Before annotation. An example from the play documentation:
#Before(unless={"login", "authenticate"})
static void checkAuthenticated() {
if(!session.contains("user")) {
login();
}
}
The user session attribute would then be put in the session only when the user has authenticated. Only authenticated users will be allowed to send HTTP requests to your save() route. Note in particular the unless and only annotation parameters.
The code above comes from the OpenID example in the Play! documentation. I have used this once and so far this seems to work perfectly.