Validation before authorization

[iljhli]

Is there a way to change this behavior? It seems like a potential vulnerability since a user could technically get validation information even if they do not have access to some resource.

This flow seems to go against most implementations, and even Laravel's.

[spawnia]

Is this essentially #1780?

[iljhli]

That feels more focused on authentication rather than authorization. Our entire graphql endpoint is behind guarded routes so no unauthenticated user can access the endpoint. What we are having an issue with is authorization for instance if a user @can do something. It's checking the validation of the mutation before it verifies the user even has permission to do that.

For instance lets say we have an order and permissions view_orders, update_order, delete_order, create_order. It's exposing validation messages before it even checks if the user can update/create. Depending on the messages this could be a potential leak.

Most flows I've encountered follow authentication -> authorization -> validation