<story><title>Vulnerabilities in the Feeld dating app</title><url>https://fortbridge.co.uk/research/feeld-dating-app-nudes-data-publicly-available/</url></story><parent_chain><item><author>dfedbeef</author><text>You shouldn&amp;#x27;t be touching the server-side code if you find this hard to keep straight.</text></item><item><author>Cu3PO42</author><text>It seems like they implemented permission checks purely in the frontend, and not just on one endpoint, but almost everywhere.&lt;p&gt;While it is conceptually easy to avoid this, I have seen similar mistakes much more frequently than I would like to admit.&lt;p&gt;Edit: the solution &amp;quot;check all permissions on the backend&amp;quot; reminds me of the solution to buffer overflows: &amp;quot;just add bounds checks everywhere&amp;quot;. It&amp;#x27;s clear to the community at large what needs to be done, but getting everyone to apply this consistently is... not so easy.</text></item></parent_chain><comment><author>benoau</author><text>Junior developer probably opened a Jira ticket, saw a UI of a permission dialog, and did exactly that task with nobody senior enough to know better.  That&amp;#x27;s how you reproduce the bugs that were in-fashion 15 - 20 years ago in my experience!</text></comment>
<story><title>Vulnerabilities in the Feeld dating app</title><url>https://fortbridge.co.uk/research/feeld-dating-app-nudes-data-publicly-available/</url></story><parent_chain><item><author>dfedbeef</author><text>You shouldn&amp;#x27;t be touching the server-side code if you find this hard to keep straight.</text></item><item><author>Cu3PO42</author><text>It seems like they implemented permission checks purely in the frontend, and not just on one endpoint, but almost everywhere.&lt;p&gt;While it is conceptually easy to avoid this, I have seen similar mistakes much more frequently than I would like to admit.&lt;p&gt;Edit: the solution &amp;quot;check all permissions on the backend&amp;quot; reminds me of the solution to buffer overflows: &amp;quot;just add bounds checks everywhere&amp;quot;. It&amp;#x27;s clear to the community at large what needs to be done, but getting everyone to apply this consistently is... not so easy.</text></item></parent_chain><comment><author>jfoutz</author><text>Eternal September. Everyone starts somewhere, it’s just all the time now. In ten years, the dev will explain to a junior how bad they messed up, and why they have to validate this way. Well, I don’t know, but that’s what I hope.</text></comment>