Why your backend workflows might be your app's biggest vulnerability

I’m going to update this thread with an obscenely useful hack.

The problem identified in this thread is as follows:

We need to verify specifically that an admin API token called this workflow (generally via a workflow/API connector action)

So, is there a way we can pretty elegantly do this?

As it turns out, yes.

Current User's unique id contains admin is functionally saying: did an admin API token call this workflow?

The reason this works is that admin tokens seem to be a property of dummy admin users (you’ll never see them in your database, but may see them in the Creator field on the Data API if you create things in the backend without a User). These have unique IDs in the form admin_user_APPID_VERSION. Hence, the condition holds. Standard users all have the standard Bubble ID form, and only admin token users have admin in their ID.

Hope this helps.

14 Likes