2

At my company, we have a new development team that has been completely rewriting all of the code for different parts of the system.

I've noticed that with one of the recent changes, you can now see the JSON data for all of the fields and values for each field that exist in our database for that particular section of an account where a user is logged in. You can do so simply by using Developer Tools in Chrome.

Is this a bad idea from an information security perspective? Why or why not?

Disclaimer: I am not part of any development team, but would like to make others aware so that this can be dealt with appropriately if it is a security concern.

2

Security is rarely a binary proposition: whether or not something is a security concern depends on the circumstances. The sort of security you need for an anonymous cat-picture voting site is different than the security needed for the president to launch a nuclear assault. As a result, only your development team can decide if this is a security concern.

What is clear is that you can access data. The next question to decide if this may be a problem is very simple: Are the users in question supposed to have access to this data?

If the data you found is data that would normally be accessible to the user through the application anyway, then it really isn't a problem at all. There are plenty of situations where you might find info in the Developer Tools that isn't visible on the page, simply because the user hasn't asked to view it yet. However, If this allows people to access data they aren't supposed to have access to, then it definitely is a problem.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for?Browse other questions tagged or ask your own question.