I'm working on a flask application which requires some authentication but not on every endpoint. I use this piece of code to exclude certain endpoints from my authentication handler.

if request.path in NO_AUTH_PATHS or (re.match(r'/dashboard/.*', request.path) is not None):
        return None

I then though what would happen if i were to make a call to https://<site_domain>/dashboard/../<restricted_path>

Fortunately I got an authentication error, and I made the call both via my browser (Firefox 71.0) and through curl v7.67. This leads me to believe that request.path is parsed as /<restricted_path> and not /dashboard/../<restricted_path>.

What I want to ask is where this parsing takes place? If it's done by curl and Firefox before forwarding the request, this method might be a huge security issue.

  • I've never heard of it done by user-agents (browser, curl), and the technique has been used to abuse badly configured sites. I suspect Flask is either "normalizing" the path before comparison (so /aaa/../bbb becomes /bbb) or it flat-out rejects paths with .. in them. Note: While /dashboard/../restricted is being caught, depending on how the regex and the rest of the app works, you might find /restricted/something/dashboard/ triggers the exclusion-from-authentication while allowing /restricted/something to deliver restricted content. – TripeHound Jan 8 at 10:38
  • Thank you for your input. Do you have any suggestions on how to handle this in a more secure way? – limeeattack Jan 8 at 10:44
  • 1
    If /restricted/something/dashboard/ "gets through" it will because it's finding /dashboard_somewhere_ in the path. You'd probably want something like ^/dashboard/ (where the ^ means "at the beginning of the string". – TripeHound Jan 8 at 10:50
  • Why don't you use a library that handles all of this for you, such as Flask-Login? This way, you will avoid easy mistakes such as this. – multithr3at3d Jan 8 at 23:34
  • Because the code isn't mine, I just began maintaining it recently. I looked into some authentication libraries but most don't really fit my use case and to implement them would probably require system wide changes. Thank you for your input though :) – limeeattack Jan 9 at 9:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.