Magebean Logo Magebean
← Back to Baseline

MB-R094

AUTOMATED Custom controllers and APIs include function-level authorization

MB-C03 Secure Coding Practices High

No missing function-level authorization evidence was detected in sensitive custom controllers or APIs. Object-level authorization requires separate verification.

Why it Matters

Custom Magento controllers, REST routes, GraphQL resolvers, and admin actions can accidentally expose sensitive data when they rely only on hidden UI links or route obscurity. Attackers can call endpoints directly.

Explicit authorization checks ensure that only allowed users, roles, or customers can read data or change state.

Verification Steps

Route and controller review

grep -RIE "class .*Controller|webapi.xml|schema.graphqls" app/code 2>/dev/null
# Check for ACL, customer session, ownership, or authorization guard usage

Direct request test

  • Call endpoint as anonymous user, wrong customer, and low-privilege admin
  • Expected: denied unless explicitly authorized

Remediation / Fix Guidance

  1. Add ACL resources for admin controllers and web APIs.
  2. Check customer authentication and ownership before returning customer/order/cart data.
  3. Deny by default when authorization context is missing.
  4. Add integration tests for anonymous, wrong-user, and authorized-user cases.
  5. Review custom modules whenever new endpoints are introduced.

Examples

Fail Example
public function execute() {
    return $this->json($this->orderRepository->get($orderId));
}
# No auth or ownership check → FAIL
Pass Example
if (!$this->authorization->isAllowed("Vendor_Module::orders")) {
    return $this->deny();
}
# Authorization checked before data access → PASS

References