Fixed, Security

Private by default

Recordings opened for anyone who had the link. Now every request is checked before a single frame streams.

  1. 01

    Symptom

    Recorded videos opened for anyone who had the direct link. No sign-in was needed.

  2. 02

    Root cause

    Media was served from a publicly readable path, with no permission check in front of it.

  3. 03

    Fix

    Moved recordings behind authenticated, permission-checked access, so only authorised reviewers can stream them.

  4. 04

    Impact

    A recording can no longer be reached by its link alone.

Steps

  1. confirm the leak in a private window
  2. map every place that builds a media link
  3. put an authorisation check in front of media
  4. re-test as anonymous, as the owner and as a reviewer

Stack

Node.js, Auth / RBAC, Object storage

Next case 04 / 06A build on a dietNext case

A thousand welcomes

What's the next big idea?