utku-guclu/authentication-and-authorisation-with-expressjs

User Deletion Security: Authentication and Authorization Best Practices

Introduction

In web applications, particularly those involving user management, it is crucial to protect sensitive actions, such as deleting user accounts. This protection is ensured by implementing both authentication and authorization mechanisms. This guide explains how to secure the user deletion process by leveraging these mechanisms effectively.

Authentication vs. Authorization

Before diving into the solution, it is important to understand the distinction between authentication and authorization:

• Authentication: This process verifies the identity of a user, ensuring they are who they claim to be (e.g., through login credentials).
• Authorization: Once authenticated, this process determines what actions the user is allowed to perform based on their role or permissions.

These two concepts are complementary. Authentication ensures the user is legitimate, while authorization ensures the user has the right to perform certain actions.

Problem Statement

We need to secure the user deletion functionality to ensure that only administrators can delete user accounts. A common mistake is allowing non-admin users to delete accounts, which could lead to severe security risks.

Example of a Problematic Implementation

router.post(
  "/delete/user",
  authentication,
  authorization({ isAdmin: false }), // Incorrect: Users can delete, which is not secure
  authController.delete_user_by_username // Delegate deletion logic to the controller
);

In this implementation, even non-admin users could delete accounts, which is a significant security flaw. Solution Overview First Approach: Using admin in authHandling

The first approach involves ensuring that only users with the admin role can delete accounts by passing an argument to the authorization middleware. This is how it looks:

router.post(
  "/delete/user",
  authentication,
  authorization("admin"), // Ensures only admins can delete users
  authController.delete_user_by_username // Delegate deletion logic to the controller
);

Benefits:

First Layer of Protection: This method ensures that only users with the admin role can delete other users' accounts.
Efficient Role Management: The middleware checks the role before proceeding, reducing the risk of unauthorized access.

Second Approach: Moving Logic to adminHandling

In this approach, the deletion logic is moved to a dedicated adminHandling function within the controller. This serves as a second layer of protection, ensuring that only admins can execute the deletion process.

// Route Configuration
router.post(
  "/delete/user",
  authentication,
  adminHandling, // Second layer of protection
  authController.delete_user_by_username
);

// Admin Handling Function
const adminHandling = (req, res, next) => {
  if (!req.user.isAdmin) {
    return res
      .status(403)
      .json({ message: "Forbidden: Only admins can delete users" });
  }
  next();
};

Benefits:

Second Layer of Protection: By moving the deletion logic to adminHandling, we add an extra layer of security, ensuring that even if a non-admin reaches this point, they cannot proceed with the deletion.
Modular and Maintainable: This approach keeps the code modular, making it easier to maintain and extend.

Conclusion

Both approaches provide robust solutions to secure the user deletion process:

First Approach: Simple and effective, utilizing role-based access control directly in the routing logic.
Second Approach: Adds an additional layer of protection by encapsulating the logic within an admin-specific handler.

By implementing these strategies, we can ensure that only authorized administrators have the ability to delete user accounts, significantly improving the security of the application.

Video Presentation

For a more detailed explanation and visual representation, please watch the video presentation here.