I encountered a data storage service with rather weird access policies. There're "folders" with "files" and each "folder" can have either of the following permissions:

  • anyone in the world can enumerate and read the files
  • anyone in the world can read the files (knowing their names in advance or guessing the names)
  • a valid access token is required to read a file

Those access tokens are generated using a procedure that is only available to registered, logged in and authorized users only - those can cause a token generation and get a link (with an access token) that they can send or publish to anyone and then anyone can use that link to access an individual file for some period of time and after that time the token expires and those random people can longer access the file unless they obtain a new link with a fresh token.

The anomaly I see is that when a "folder" has "anyone can read the files" permission set then anyone can access any file using an URL like


but if he uses a link with an expired token like


then he cannot access the file. This doesn't make much sense, does it? If I can open the door without a key it means the key doesn't matter so I can just as well use any key.

Are there any use cases in which the model described above (access granted without key but denied with a wrong key) does make sense?

  • This proofes poor programming. The programmer first checks whether an access-token is part of the input and then validates it instead of first checking whether a token is required and then, in case it is, check for its presence and validity. – marstato Jul 21 '14 at 7:50
  • This could also allow an attacker to check token validity / expiration. Not necessarily a problem but it could allow an attacker to calculate how long issued tokens remain valid. I'm trying to dream up scenarios where this is useful but I'm drawing a blank. – jhoyla Jul 21 '14 at 12:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.