search

fullcube / loopback-component-access-groups

Access controls for Loopback.
59 stars 21 forks source link

Undocumented access control bypass mechanisms #8

Open RossWilliams opened 8 years ago

RossWilliams commented 8 years ago 
if (ctx.options.skipAccess) {
  debug('skipAccess: true - skipping access filters');
  return next();
}
// Do not filter if the request is being made against a single model instance.
if (_get(ctx.query, 'where.id')) {
  debug('looking up by Id - skipping access filters');
  return next();
}

These two access bypass mechanisms are undocumented and could expose data to unauthorised users.

  1. Document these bypass mechanisms
  2. Allow users to disable these through configuration options.