I am writing a server where I have an entity StoreOwner
that "owns" or has a @OneToMany
relationship to a Store
entity (one store owner has 1 to N stores). Each Store
has Offer
and Item
, each also have a @OneToMany
relationship with the store (one store has 1 to N offers and 1 to N items).
I am already using GWT Xsrf protection and a session ID that gets associated with the logged in user after each log-in (cookie).
There's one thing missing IMHO: what if a logged in user sends a delete request to the server with IDs of items that he does not own of a store he does not own either? At the moment, I am doing this in my StoreService
:
// StoreService.java
@Transactional
public ItemDTO deleteItem(String sessionId, Long storeId, ItemDTO itemDto) {
// sessionId is the cookie I have placed in my database
// This way I want to ensure that I am only accessing a store
// that is associated with the logged in store owner (the user basically)
Store store = this.storeOwnerRepository.getStore(sessionId, storeId);
Item item = ConvertDTO.convertItem(store, itemDto);
// Check if the store ID that I got using the cookie is the
// same ID as the store ID from the item that should be deleted
if(item .getStore().getId() == store.getId()) {
item = this.storeOwnerRepository.deleteItem(item);
} else {
// If this didn't work we have a potentially hostile user:
throw new RuntimeException("Is somebody trying to delete items of a store he doesn't own?");
}
itemDto = ConvertEntity.convertItem(item);
return itemDto;
}
It is the first time that I am trying to write a bigger server application and I want to prevent users from doing such things.
My question is twofold: [1] does what I am doing would really prevent a logged in user from smuggling the IDs of another store he does not own to my server? In addition, [2] can I simplify this a little bit?
My problem is that as the application grows one might - every now and then - forget this check
if(item .getStore().getId() == store.getId()) { /* .. */ }
Of course, I could move that into my StoreOwnerRepository
, but do I have better options?