Security Issue -- Why Does the Data API return a success response for unauthorized users?

[georgecollier]

@jacob10

Because why is any person on the internet able to access my app’s API if I don’t want them to?

Because you allowed them to, by virtue of enabling the data API. If you don’t want them to, disable the data API. You can create a backend workflow if you want that will accomplish the same thing as the data API (though your backend workflow will also be public so what’s the point?)

@jacob10

“Yes, this endpoint is available to hit.” I don’t want anyone to know that. It’s revealing way more information than I’d want, and I feel naked.

If you have privacy rules, the data is secure.

I cannot emphasise this enough:

Privacy rules are the only thing that protect data visibility in Bubble. No matter if your data API is enabled/disabled, backend workflows exist/don’t exist… any data permitted by privacy rules is accessible.

You may find some info in this thread useful:

Bits of your Bubble app you might not know are public

I wanted to write something up for people specifically looking to know how deep someone can dive into your app. Let’s poke around the https://bubble.io app to find out. This isn’t a post to attack Bubble, but to educate people as to what’s actually shared by Bubble to the end user as it isn’t really talked about in most developer circles, and whether you like it or not, this is how it is so be aware of it. This list isn’t exhaustive (you can also see plugins, the Swagger file is enabled by defau…