Fix: Excessive Data Exposure on GET /users/v1/_debug (Challenge 5)

api_views/users.py

@@ -22,6 +22,12 @@ def get_all_users():
 
 
 def debug():
+    resp = token_validator(request.headers.get('Authorization'))
+    if "error" in resp:
+        return Response(error_message_helper(resp), 401, mimetype="application/json")
+    requester = User.query.filter_by(username=resp['sub']).first()
+    if not requester or not requester.admin:
+        return Response(error_message_helper("Only Admins may access debug data!"), 403, mimetype="application/json")
     return_value = jsonify({'users': User.get_all_users_debug()})
     return return_value
 

models/user_model.py

@@ -56,7 +56,9 @@ def json(self):
         return {'username': self.username, 'email': self.email}
 
     def json_debug(self):
-        return {'username': self.username, 'password': self.password, 'email': self.email, 'admin': self.admin}
+        # Even for admin-only debug access, plaintext credentials should never be
+        # serialized back out over the API - that is excessive data exposure by itself.
+        return {'username': self.username, 'email': self.email, 'admin': self.admin}
 
     @staticmethod
     def get_all_users():

openapi_specs/openapi3.yml

@@ -89,9 +89,11 @@ paths:
     get:
       tags:
         - users
-      summary: Retrieves all details for all users
-      description: Displays all details for all users
+      summary: Retrieves all details for all users (admin only)
+      description: Displays all details for all users. Requires an authenticated admin bearer token.
       operationId: api_views.users.debug
+      security:
+        - bearerAuth: []
       responses:
         '200':
           description: See all details of the users
@@ -111,12 +113,13 @@ paths:
                         email:
                           type: string
                           example: 'mail1@mail.com'
-                        password:
-                          type: string
-                          example: 'pass1'
                         username:
                           type: string
                           example: 'name1'
+        '401':
+          description: Missing or invalid auth token
+        '403':
+          description: Authenticated user is not an admin
   /users/v1/register:
     post:
       tags: