Expense reports, refunds, access requests and production deploys often go through an approval step. The check behind the Approve button is usually a role check: can this user approve requests of this type? A manager can, so the call goes through.
Problems start when that manager files a request of their own. They submit an expense, open the approvals queue, and their own request is sitting there with an Approve button next to it. If the endpoint only looks at the role, clicking it works. Delegation opens the same hole from another side: the manager goes on vacation, hands approvals to a teammate, and the teammate approves a request they filed last week.
In the approve handler, load the request and reject the call when the approver (or the person they're acting for) is the requester. Do this next to the role check, on the server. Hiding the button in the UI is nice, but anyone can still send the request with curl.
Also pin the approval to what was approved. If the requester can edit the amount after approval, they can get a $40 expense signed off and change it to $4,000. Store a version number or hash on the request and have the approval apply to that version only, so any later edit sends it back to pending.
To test it, give a user approver rights, submit a request as that user, then call the approve endpoint on it directly. If you get a 200, self-approval is open.
Top comments (0)