Security implications of ACL resources on different servers
@csarven is already working on this.
Since May 17, 2021.
Assessment
This issue has not been assessed yet.
Description
Rough text from auxiliary resource:
A given
Solid resource MAY Link to auxiliary resources on a different server under a
different authority, per the configuration of the Solid server on which that
resource resides.
If that goes through...
This entails that an ACL resource can be on a different server.. and so raises security issues that should be addressed.
-
Will agent(s) controlling a resource on server-A be authorized to request write operations on the ACL on server-B? Ditto the application.
-
What should happen if/when remote ACL becomes inaccessible (for whatever reason for any period)?
-
What should happen if/when remote ACL is compromised?
-
Would the server need to be authenticated and authorized like any other agent in order to:
- name the ACL URI on different server, and making sure that the ACL can be created/modified (because it needs to have a link relation from primary resource to the ACL)
- delete the associated ACL on different server?
- Dominant language
- HTML
- Stars
- 131
- Forks
- 29
- PR merge metrics
- No merged PRs in 30d
Getting set up
This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from solid/web-access-control-spec
-
Difficulty 5/5 Over a week Newbie friendliness 35/100
solid/web-access-control-spec#139 · 6 comments · 1 reaction ·
-
Difficulty 5/5 Over a week Newbie friendliness 35/100
solid/web-access-control-spec#137 · 1 comment ·
-
Difficulty 5/5 Over a week Newbie friendliness 30/100
solid/web-access-control-spec#136 · 1 comment ·
-
Difficulty 5/5 Over a week Newbie friendliness 30/100
solid/web-access-control-spec#135 ·
-
Difficulty 5/5 Over a week Newbie friendliness 25/100
solid/web-access-control-spec#130 ·