Administrativ dashboard i Optimizely CMS - Säkerhetsanalys av API-kommunikation och åtkomstkontroll

Abstract

The following thesis aims to investigate security aspects of API and web applications. Those include broken access control and secure communication between systems. Furthermore, the work consists of developing an Optimizely based web application that uses a backend-API for a lot of its logic. Several security mechanisms were then implemented in different layers. The web application has security for authentication, session handling and role-based access control which together work to make administrative resources restricted. The communication between the systems is protected with a server-side proxy which stops the API-key from being exposed in the browser. The other layers of security are left to the backend-API that handles API-key validation, project membership authorization, input validation, rate limiting, audit logging and supplementary defenses with CORS and Content Security Policy. The implementation was tested from an attacker perspective that utilizes browser DevTools, terminal for requests and local traffic inspection with Fiddler. The results show that the implemented solution mitigates the risk of unauthorized access and follows central security principles even if it still has limitations. For example, the use of a shared symmetric secret between the systems and the solution was only tested in a local development environment.