How to avoid exposing IDs of JPA entities to end users - spring

Question

I have an Spring MVC application, which as it stands, exposes the IDs of JPA entities to users (in hidden html inputs or browser urls).
This could allow a malicious user to perform operations on entities belonging to another user using their browser.
Can anyone please suggest a solution to this security problem?
Is encrypting/decrypting IDs a good solution?
If so, in which layer (web, service, repository) is it appropriate to do this?
Which encryption solution is recommended (symetric/asymetric)?
Is there a better solution?

Answer 1

There is a better solution. You can keep your user ID's as primary keys for some purposes, but for this particular purpose I would suggest create a column in all the tables you need, for e.g. called: IDENTIFIER and generate some strong random ID for it, I am using this to generate ID's:
public static String generateId() {
return UUID.randomUUID().toString().replaceAll("-", "").toUpperCase();
}
Then you can use these identifiers in your views. I also wrote a generic method for JPA to find entities which have these kind of columns:
public T findByGeneratedId(String generatedId) {
CriteriaBuilder cb = this.entityManager.getCriteriaBuilder();
CriteriaQuery cq = cb.createQuery();
Root<T> entity = cq.from(entityClass);
CriteriaQuery query = cq.select(entity).where(
cb.equal(entity.get("generatedId"), generatedId));
try {
return (T) this.entityManager.createQuery(query).getSingleResult();
} catch (RuntimeException e) {
return null;
}
}
Note that my column is called GENERATED_ID and all entities has a field:
#Column(name = "GENERATED_ID", nullable = false, unique = true)
private String generatedId = generateId();
This will guarantee the uniqueness and safeness across your entities and there is no need for some complex encoding/decoding stuff.

Answer 2

In my opinion, encrypting IDs is not a good idea, more like hiding the real problem. And it would probably be quite tricky to do cleanly. And a malicious user could still intercept another user's requests and use the encrypted Ids to perform attacks.
The real solution is to implement some kind of access control in your business logic, and refuse attempts to access unauthorized resources, such as en entity belonging to another user.
You could implement this logic yourself if it is simple (no shared entities belonging to several users, no groups, just entities belonging to one user, that should be quite straightforward).
You could implement it as a sort of interceptor (using aspect-oriented, add an aspect to your DAO or service methods for example) in order to do it automatically and avoid too much repetitive boilerplate code.
You could also use Spring Security which has some mechanisms for Access Control.
If the needs are more complex, Spring Security can be used to implement a full ACL (Access Control List) system on your domain objects. This is more complex because ACLs are stored separately, so it needs some exxtra infrastructure in the database, and it seems quite complex to configure right, but it is the more flexible and scalable solution in my opinion. I haven't implemented ACLs myself though, so I can't offer much concrete advice on this.
If you insist on hiding the ids from the users, I suggest you don't really encrypt the IDs but use a per-session correspondance table between the real IDs and some randomly generated temporary ones. This way you avoid frequent crypting/decrypting of IDs and make one visible id totally useless for another user.
Hope this helps.