Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[wallet-api] Inconsistent error codes when using the wrong wallet-id to access api #509

Closed
mikeplotean opened this issue Jun 19, 2024 · 1 comment
Assignees
Labels
bug Something isn't working

Comments

@mikeplotean
Copy link
Contributor

Description

When trying to reproduce horizontal privilege escalation and use a wallet-id which is not assigned to currently logged in account, for different endpoints there are different error codes and response types.

Environment

Steps to reproduce

  1. register account
  2. log into wallet
  3. copy wallet-id
  4. register another account
  5. log into wallet
  6. use the wallet-id from step#3 when accessing authorized api (e.g. list dids, keys, events, generate key, did, etc)

Expected

  • error code 400 is received
  • error message says "This account does not have access to the specified wallet."

Actual

  • for some apis, e.g. list events, generate key
    • error code 400 is displayed
    • error message "This account does not have access to the specified wallet."
  • for other apis, e.g. list dids, create did:jwk
    • error code 500 is displayed
    • error message
{
    "exception": true,
    "status": "Internal Server Error",
    "code": "500",
    "message": "This account does not have access to the specified wallet."
}
@mikeplotean mikeplotean added the bug Something isn't working label Jun 19, 2024
@SuperBatata SuperBatata self-assigned this Jul 12, 2024
@SuperBatata
Copy link
Contributor

should be fixed with this pr : #597

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

When branches are created from issues, their pull requests are automatically linked.

2 participants