Any customer can access any other customers' orders?
Author: jgschisCreated Apr 11, 2023Updated Oct 29, 2023
In in the orders controller, there is a method to get an order by its id. It seems like any logged in customer could pass any order id, and the system would return it. Shouldn't the API enforce that only orders belonging to the logged in customer be returned?
method: GetOrderAsync
[Route("{orderId:int}")]
[HttpGet]
[ProducesResponseType(typeof(Order), (int)HttpStatusCode.OK)]
[ProducesResponseType((int)HttpStatusCode.NotFound)]
public async Task<ActionResult> GetOrderAsync(int orderId)
{
try
{
//Todo: It's good idea to take advantage of GetOrderByIdQuery and handle by GetCustomerByIdQueryHandler
//var order customer = await _mediator.Send(new GetOrderByIdQuery(orderId));
var order = await _orderQueries.GetOrderAsync(orderId);
return Ok(order);
}
catch
{
return NotFound();
}
}Source: dotnet-architecture/eShopOnContainers