Votes
1
Replies
24
Participants
Unknown
Messages
25
Rank 1: Thread
Give me a sec
Where do you use loadSession besides logout?
Rank 1: Thread
func login(email: String, password: String) async throws -> [String: Any] { if let savedSession = loadSession() {Rank 1: Thread
And on the login page
Rank 1: Thread
.onAppear { if let session = authenticationNode.shared.loadSession() { if let _ = session["userId"] as? String { isUserLoggedIn = true } } }You are not authenticating the user anywhere. It appears you only check whether you haved stored a session object in the keychain
AFAIK the apple sdk should also automatically persist the session for you
Rank 1: Thread
What do you mean by this? And how does this end up authenticating the image upload?
Rank 1: Thread
It doesnt, when I swiped up the app and re-launched it, I had to login again
Can you call the Accounts.get() endpoint after relaunching your app
What permission did you set for that bucket?
Rank 1: Thread
Rank 1: Thread
and I also enabled file level permissions
Rank 1: Thread
👍 ok one second
Rank 1: Thread
should I remove all the keychain shenanigans then put that?
You have to be authenticated in order to upload in your case
So you are definitely authenticated.
Yeah sure. Makes debugging easier
Rank 1: Thread
Yes I know, but the thing is, if someone logins in with account A they can snoop the network requests, and send a request with their authentication but giving everyone file permissions to see their file. So user B will be able to see it too.
Rank 1: Thread
That's what I'm scared of.
Can you elaborate your concerns a little bit further? Not sure if I can follow
Rank 1: Thread
Alright one sec
What possible attack scenario are you trying to prevent?
Rank 1: Thread
Let's say Bob has logged into my app. Bob uploads an image but inspects the network logs. Bob now has the network request to upload an image to my bucket. The network request Bob has uploaded has all these parameters:
bucketId: "66cc7031002044095926", fileId: "unique()", file: InputFile.fromData(data, filename: filename, mimeType: "image/jpeg"), permissions: [ "user:\(userId).read", "user:\(userId).write" ]Bob notices the 'permissions' parameter. Bob decides to cange it from user:userid.read to Role.any.
John decides to log into the app. John sees all of his uploads but then spots an upload that isn't his. This upload is the image that Bob sent with the Role.any permission.