Security non persisten entity

0
Hello all!   We created a app for our company in witch we merge different forms that the customer has to fill in into one app. We combine those forms into a overview page with all the different measures. In order the secure the app we created a non persistent entity called “Userhelper” witch is the page parameter for ever form. The “Userhelper” is connected to a entity called “Person” witch is connected to the System.User. We connected to the System.user so we can monitor make the enitity only visible for the “CurrentUser”.    The problem is that when we send the data to our CRM the non persistent entity “Userhelper” is getting garbage collected. We want to make a redirect to our “Thank you page” at the end of the app. Now, because the “Userhelper” is getting garbage collected this is not possible.    There was a microflow which basically was setting the association between Person and System.User to empty. We removed this part of the microflow, so now the “Userhelper” keeps excisting.    My main question is, how mutch of a security hazard is this? I mean to maintain this connection infinetly.
asked
2 answers
0

I dont see any security threats since now in the new situation the Userhelper will be garbage collected, when Person will be garbage collected (when it is no longer used on page).

 

If you want to be sure, you should make an association from the Userhelper to the Session (System entity) with delete behavior that removes the Userhelper when Session is removed. This way you are sure the Userhelper object no longer lives than allowed and it wont be garbage collected as long as the session runs.

 

answered
0

This is a hard one to answer without the model. You should a tool like the security inspector: https://marketplace.mendix.com/link/component/106594 to double check if this is an issue or not. Because if the end user can now see more more data about the Person object it might be problamatic. But if the person can only see it's own Person data it is no problem. So do use such a tool or Javascript to check this.

Regards,

Ronald

 

answered