Security concern for Asp,net MVC app when invoking action method from javascript

Question

I have added the Authentication attribute on controller classes which are for admin purposes like adding, removing categories and product. All such controllers(ManageCategory, ManageProduct) are decorated with following :-

[Authorize(Roles = "Administrator")]

These controllers have Upload and Remove action methods which are invoked by jquery from the rendered view. Since client script don't use the URL or postback, I am bit skeptical if someone can bypass the controller authorization. These action methods are very sensitive because it provides the ability to remove a file on server. Following is the code from Remove action method.

[HttpPost]
public ActionResult Remove(string fileName)
{
    string completFileName = Server.MapPath("~" + fileName);
    System.IO.File.Delete(completFileName);
    return Json(true);
}

Though this action method resides in a Controller with Authorization, Can someone still reach it without logging-in. Should i be worried and do something else or one will always need to be authorized as administrator before accessing this ?.

That's a question of whether you trust ASP.NET MVC's Authorize construct for controllers. The answer is either "trust them" or go read their source — Raynos
– Raynos, Commented Dec 13, 2011 at 13:12
@Raynos I see you are an expert in javascript and jquery. Can you access this action method on my website via some script injection and delete a file ?? — Pankaj Upadhyay
– Pankaj Upadhyay, Commented Dec 13, 2011 at 13:17
I don't know, I can certainly try, whether the Remove method would be invoked depends 100% on how Authorize works. So basically, if you don't trust it go confirm it works correctly by reading the source — Raynos
– Raynos, Commented Dec 13, 2011 at 13:20
I invoked the upload action method from another view after logging out and got the HTTP Error. — Pankaj Upadhyay
– Pankaj Upadhyay, Commented Dec 13, 2011 at 13:33

Carson63000 · Accepted Answer · 2012-07-27 11:50:24Z

3

I'm not sure what you mean by..

Since client script don't use the URL or postback

AJAX requests from client script send cookies just the same as regular page requests - have a look at the headers of an AJAX request using Firebug or Fiddler or some such tool.

This includes the .ASPXAUTH cookie which standard ASP.NET authentication uses. The controller will perform exactly the same authentication checks on an AJAX request as it would on a normal page request.

edited Jul 27, 2012 at 11:50

answered Dec 14, 2011 at 5:05

Carson63000

4,2232 gold badges27 silver badges38 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

StuperUser · Accepted Answer · 2011-12-13 15:04:52Z

1

Controller level attributes are applied to all actions in that controller, so Upload() and Remove() will behave as though they are decorated with:

[Authorize(Roles = "Administrator")]

answered Dec 13, 2011 at 15:04

StuperUser

10.9k14 gold badges85 silver badges143 bronze badges

Collectives™ on Stack Overflow

Security concern for Asp,net MVC app when invoking action method from javascript

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related