Attack vector arising from naive developer use of the `+layout.server.js` tree

### Describe the bug __tldr;__ - The existence of the `+layout.server.js` tree will lead folks to put logic there rather than in `+page.server.js`. - Because SvelteKit decides on the client what to fetch from the tree, there are edge cases where important (e.g., authorization) logic in `+layout.server.js` is skipped. - This may seem a contrived edge case, but it is an attack vector that needs to be addressed through documentation. ------ Consider the following case. (Repo link below) ``` src └── routes └── launch-codes ├── +layout.server.js ├── +page.server.js └── +page.svelte ``` Let's say I naively (but I think quite naturally) do the following things: - I place authentication/authorization logic in the `+layout.server.js` file. Perhaps I plan to elaborate this section of the site with `launch-codes/[id]`. - Meanwhile, I use `+page.server.js` to fetch a paged list of codes from the database. Essentially I have separated the concerns of authorization and data collection. Now this is totally secure as long as my user remains signed in. But let's say the following happens: - The user goes to `/launch-codes`. This first page view runs the authorization logic in `+layout.server.ts`. - They are signed out, say on another tab, or because the cookie expires, or just by deleting the cookie in the console. - In the original tab, now signed out, they go to `/launch-codes?page=2`. The authorization logic in `+layout.server.ts` is skipped, and t

Posted by cdcarson on Aug 26, 2022, 2:01 PM

Tags

• github (Sysadmin)

Related issues

• Custom games stuck on "finding server" for all european servers
• Feature request: add ACP (Agent Client Protocol) stdio JSON-RPC mode
• Forza Horizon 6 (2483190)
• Turn off integrated browser for default
• Weekly updates are too frequent
• [BUG] Max 20x plan: 100% usage after 2 hours of light work (5 commits, no agents)