Is the OData Protocol susceptible to Insecure Direct Object References?

Question

The Open Data Protocol or OData is a great protocol created on top of Web Technologies.It uses the URI convention for the data exchange using Atom, JSON and XML. You can use the URI convention (parameter &) to perform your query:

?productCode=14&date=20110101&$format=JSON

Let's suppose that this is the query to retrieve information related to a specific product in our repository. My point in that somebody could see this query format in a Web page and modify it to retrieve another product, even when it is not authorized to access it. This scenario can shows up when those OData Services are consumed using a Client Side approach like JQuery.

Does that make sense?

Answer 1

The key to Insecure Direct Object Reference is the insecure bit. While it's not always a great idea to use direct object references sometimes you just have to because thats the schema of the data and you can only use the schema of the data. OData is one of those cases. So here you are stuck with managing the insecure bit, and OData doesn't have any authentication or authorization mechanism built in. You have to build in the auth schemes.

So to answer your question, OData is only insecure as long as you haven't set up authn or authz for the particular objects.

Answer 2

I think this is true for all URLs, whether they use the OData protocol or just display a web page:

http://security.stackexchange.com/questions/8326

The authorisation has to be done at the time the request is processed. For example you cannot access this question unless you have enough reputation:

http://stackoverflow.com/questions/686216

Keeping URLs secret for more than a couple of hours does not work, even when they are not guessable, because many people use browser extensions that report every visited URL to the major search engines.