I am trying to figure out how would you fix Missing Function Level Access Control vulnerabilitiy in the framework. I think this is the most basic and common vulnerability that most apps on the marketplace are vulnerable to. Basically, all endpoints in ac-express and ac-spring-boot are authenticated…

It would be very interesting to see this added to the token. Currently I have implemented a workaround that collects the current user permissions using the /rest/api/3/mypermissions endpoint so that the app can validate that only admins have access to the admin pages of the app, but this generates …

Anyone ending up here in 2021, may also have a look at this post here (discusses the same issue): [image] Fastest way to check whether the user is admin from app backend Jira Cloud Hi, We are developing a Jira Cloud app and need to check whether the given user is admin fo…

Missing Function Level Access Control vulnerability in ac-express and ac-spring-boot

Atlassian Developer Tools

tbinna October 28, 2021, 3:05am 3

Anyone ending up here in 2021, may also have a look at this post here (discusses the same issue):

And the open feature request here: [AC-2529] - Ecosystem Jira