-
-
Notifications
You must be signed in to change notification settings - Fork 468
Is there a way to change this behavior? It seems like a potential vulnerability since a user could technically get validation information even if they do not have access to some resource.
This flow seems to go against most implementations, and even Laravel's.
All reactions
Replies: 1 comment 1 reply
Is this essentially #1780?
All reactions
That feels more focused on authentication rather than authorization. Our entire graphql endpoint is behind guarded routes so no unauthenticated user can access the endpoint. What we are having an issue with is authorization for instance if a user @can do something. It's checking the validation of the mutation before it verifies the user even has permission to do that.
For instance lets say we have an order and permissions view_orders, update_order, delete_order, create_order. It's exposing validation messages before it even checks if the user can update/create. Depending on the messages this could be a potential leak.
Most flows I've encountered follow authentication -> authorization -> validation