Critical Security: Over-Fetching Sensitive PII in CHECK_AUTH Query in Queries.ts

[sancheet230]

Description

The CHECK_AUTH query exposes Personally Identifiable Information (PII) such as birthDate, phone.mobile, educationGrade, employmentStatus, and maritalStatus, which are unnecessary for authentication checks. This violates privacy best practices and regulatory standards (GDPR/CCPA).

Steps to Reproduce

Authenticate as any user.

Execute the query:

query {  
  checkAuth {  
    birthDate  
    phone { mobile }  
    educationGrade  
    # ... other sensitive fields  
  }  
} 

Observe: Sensitive user data is returned.

Impact

Data Privacy Violation: Unauthorized exposure of PII to authenticated users.

Compliance Risk: Potential fines under GDPR/CCPA for improper data handling.

Attack Surface Expansion: Compromised accounts can harvest sensitive data.

Proposed Fix

Minimize Fields: Fetch only essential data for authentication (e.g., _id, email, firstName, image).

Field-Level Permissions: Use GraphQL directives (e.g., @auth) to restrict sensitive fields.

Backend Validation: Ensure resolvers enforce access control.

Revised Query:

query CHECK_AUTH {  
  checkAuth {  
    _id  
    firstName  
    email  
    image  
  }  
}  

Recommendations

Audit All Queries: Identify and fix similar over-fetching in USER_DETAILS, USERS_CONNECTION_LIST, etc.

Role-Based Access Control (RBAC): Implement schema-level permissions with tools like GraphQL Shield.

Logging: Monitor access to sensitive fields.

P0: Requires immediate resolution to mitigate legal and reputational risks.

[sancheet230]

@palisadoes @Cioppolo14 I know this issue and I can work on this If you give me chance by assigning

[sancheet230]

Opened this issue in the Talawa API repository to address the necessary backend changes required for resolution

[palisadoes]

Which branch is this for?

[sancheet230]

@palisadoes main branch

[palisadoes]

We are focusing on the develop-postgres branch until further notice

[sancheet230]

@palisadoes ok will stick with develop-postgres branch from now on thanks for clarification