We wrote a simple .NET (C#) desktop application in Wpf. We also used WIF (Windows Identity Framework) to get a list of claims for the authenticated user. Some examples are:
- CanOverrideSalesAmount
- CanAddContact
- etc.
This works fine and all, the client seems very protected. But, when I was debugging the application it occurred to me that all of the authorization is happening on the client side. A devious person could use a tool such as Snoop to hook into the application and make changes to the domain model that s/he isn't supposed to do.
We thought about moving the authorization checks on the property setters, but even that isn't good enough because when we serialize the object graph to send over the wire, the serialized data can be altered (far fetched, but still possible).
It seems to me that the only true way to protect my object graph is to have it only reside on the server and to have the client make calls to update it, but that seems like such an overkill. Is there a better way to handle this situation? I want our application to be as secure as possible.
Best Answer
The problem with authorization checks only on the client side is that ultimately an attacker can mimick the behaviour of your application. Robert Harvey argues that it's unlikely for your users to debug the compiled application or to look at the network traffic. It very well may be.
The problem is that it's not rocket science to find out what's going on. And if somebody breaches the security, you may never know, because to the server, everything looks like the regular traffic.
So, the answer is you may try to protect your application by obfuscating it and by encrypting the traffic to the server, but this just raises the bar for a successful breach. Videogame and movie producing companies invest serious effort into developing protection for the software or the content on an untrusted device, but you can see these protections being circumvented quite soon. Running the security-critical part on a trusted computer (like a server) scales much better in terms of effort vs. security.