744
Strategy = Libraries or Frameworks
Use a vetted library or framework that does not allow this weakness to occur or provides
constructs that make this weakness easier to avoid. For example, consider using libraries with
authentication capabilities such as OpenSSL or the ESAPI Authenticator [REF-45].
Phase: Implementation
Phase: System Configuration
Phase: Operation
When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use
the provider's controls to require strong authentication for users who should be allowed to access
the data [REF-1297] [REF-1298] [REF-1302].
Demonstrative Examples
Example 1:
In the following Java example the method createBankAccount is used to create a BankAccount
object for a bank management application.
Example Language: Java (Bad)
public BankAccount createBankAccount(String accountNumber, String accountType,
String accountName, String accountSSN, double balance) {
BankAccount account = new BankAccount();
account.setAccountNumber(accountNumber);
account.setAccountType(accountType);
account.setAccountOwnerName(accountName);
account.setAccountOwnerSSN(accountSSN);
account.setBalance(balance);
return account;
}
However, there is no authentication mechanism to ensure that the user creating this bank account
object has the authority to create new bank accounts. Some authentication mechanisms should be
used to verify that the user has the authority to create bank account objects.
The following Java code includes a boolean variable and method for authenticating a user. If the
user has not been authenticated then the createBankAccount will not create the bank account
object.
Example Language: Java (Good)
private boolean isUserAuthentic = false;
// authenticate user,
// if user is authenticated then set variable to true
// otherwise set variable to false
public boolean authenticateUser(String username, String password) {
...
}
public BankAccount createNewBankAccount(String accountNumber, String accountType,
String accountName, String accountSSN, double balance) {
BankAccount account = null;
if (isUserAuthentic) {
account = new BankAccount();
account.setAccountNumber(accountNumber);
account.setAccountType(accountType);
account.setAccountOwnerName(accountName);
account.setAccountOwnerSSN(accountSSN);
account.setBalance(balance);
}
return account;
}
CWE Version 4.14
CWE-306: Missing Authentication for Critical Function
CWE-306: Missing Authentication for Critical Function