Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Authentication should be checked earlier in the server pipeline #93

Closed
yallie opened this issue Dec 5, 2024 · 0 comments
Closed

Authentication should be checked earlier in the server pipeline #93

yallie opened this issue Dec 5, 2024 · 0 comments

Comments

@yallie
Copy link
Collaborator

yallie commented Dec 5, 2024

Describe the bug
During the call to remote server, authentication should be checked before the server component is created.
Currently, there is a way to execute server component constructor without authentication.
Component constructor can potentially do something sensitive or time-consuming.
I consider it as a security breach.

To Reproduce

  1. Enable server.Config.AuthenticationRequired = true.
  2. Add to your component constructor: Console.WriteLine("I'm not authorized! Woohoo!");
  3. Connect to the server without credentials.
  4. Call any method and get authentication error.
  5. Observe that constructor code was actually called on server.

image

Expected behavior
Server shouldn't try to create the requested component if authentication is required but not performed.

Additional notes
I'm going to create a pull request demonstrating this issue.

yallie added a commit to yallie/CoreRemoting that referenced this issue Dec 5, 2024
yallie added a commit to yallie/CoreRemoting that referenced this issue Dec 5, 2024
@yallie yallie closed this as completed in 70aaa33 Dec 5, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant