DEV Community: Ashok Chakravarthi Nagarajan

Birth of Worker Microservice from Monolithic code

Ashok Chakravarthi Nagarajan — Fri, 20 Nov 2020 09:36:48 +0000

This story is all about the creation of TWO Microservices that were extracted from the Monolithic System.

Domain: Online Bill Payment / Financial

Tech Spec: Java, Spring Boot, PostgreSql, Redis, Kafka, Azure

Whenever there is a repetitive work happening in any System, the idea of modularization should be implemented. The same thing happened in the project that I have been working on. I proposed this idea to my team with POC and felt heard, when the team and my boss appreciated my idea.

Happily took my first step for this little milestone. There are many places in the monolithic system project calling the External Broker Service for the below needs:

To fetch Bill details

Company details that the bills were paid for.
Paying the Bill through Integrated service.
Confirming the Bill Payment.

Also there are other microservices that are calling these apis from many places directly to the Broker Service. I created the Worker/External Utility service that receives Internal http calls from these local services and makes External https calls to External Broker Service.

Later at a point of time, the entire logic is of Worker Microservice consumption is developed as Jar file and added as a Dependency for all required Monolithic and other microservices. The microservice is now busy with serving the Centralized Traffic of 75% utilization every hour.
The secondary microservice that I mentioned earlier was a Mocking Microservice for other consumer Services in development & UAT setups.

Unearthing Security issues in web apps Part-2

Ashok Chakravarthi Nagarajan — Fri, 20 Nov 2020 09:35:48 +0000

Secret way for Unprivileged user to see all Corporate Card transactions through a vulnerable api.
OWASP Category: IDOR (https://portswigger.net/web-security/access-control/idor)
There is a famous Expense reporting app for Corporates and Enterprises. It had an api
https://expense.company.com/api/v1/banks
that gives the list of banks associated to the particular organization. It also had a parameter called entity which was the gateway to the vulnerability that I found.

The typical value of the entity parameter was bank. I checked the same api with the param value card. It worked!! I successfully retried the list of card ids related to the Corporate account. Still one more way to complete the hack. We haven’t seen the list of transactions for the unprivileged the user like me.

I completely scanned the application for the particular api. With tired less analysis and hardwork I finally found the api.
https://expense.company.com/api/v1/transactions?account_id={card_id}
It gives me the list of corporate expenses that I was not supposed to view. That left the Company transactions exposed to simple staff user. Hard work paid off in form of bounty.

Thanks for reading. Happy Hacking!!

Unearthing Security issues in web apps Part-1

Ashok Chakravarthi Nagarajan — Fri, 20 Nov 2020 07:35:07 +0000

Security is the most important area which many application developer’s and its management never invest on.
Here is my story how did I find security issues effortlessly and got awarded with huge bounty.
Jazz Cinemas-Avengers-EndGame IMAX
Jazz Cinemas are the biggest Cinema Theatre Company in India. Where I was able to purchase 3 thousand Rupees worth movie tickets, cold beverages and snacks for me and my friends for just One Rupee. Yes you heard it right.

The hacking technique was simple. I just intercepted the movie ticket cart Purchase call with the help of BurpSuite Community Edition app and modified the amount with Just one rupee for the movie Avengers-EndGame IMAX.
Tada!! The Purchase was successful. I was not sure if there will be a manual check at the Theatre, but there is none. Myself with my friends were able to go to the movie theatre with the hack produced ticket and even at the interval time we received our beverages and snacks.

They didn’t find anything suspicious or the manual check even after 10 days of the Incident. Of-course what to expect from a corporate and the vulnerable IT team. But its time to be honest with the victims. I mailed them the vulnerability details and acknowledged the issue. Felt Proud!

Cloud Service Performance Improvement

Ashok Chakravarthi Nagarajan — Fri, 20 Nov 2020 07:33:43 +0000

I have successfully completed more than dozens of Performance improvement operations in my apps hosted in Cloud. The recent encounter was very important one and I have set a significant milestone improvement.
Tech Spec: Java, Spring Boot, MySql, Redis, Kafka, AWS.
Let me jump into the details of what I have accomplished and how.

The Great Issue:
Customers in an entire Data Center started facing slowness occasionally. The slowness issue started piling up over a period of time. In one fine day, all of a sudden we received lots of reports from customers.
Solution:
Phase #1: (Quick & Immediate Solution)
To the rescue I volunteered the operation to lead and work in field. Application server logs are just fine, except some locks timeout logged here and there. I came up with the idea of increasing the lock time bit more, with below configuration.
innodb_lock_wait_timeout=500
which was 5 seconds of waiting time for the lock to release and acquire it.
Good News!! The issues was temporarily solved. I knew it was not the permanent or Optimized solution. I started digging where is the real issue lies in code. In the Purchase Order (Module A) module flow, we have an option to create payments from bulk PO (Module A). The action dries up the MySql Thread Pool high by repeatedly calling DB read operations for the same Process Order (Module B) resources.
With patience and Step by Step debugging I was able to find and reproduce the issue and I had planned for the fix. Caching to the Rescue.

Phase #2:
With the help of simple HashMap to maintain the Process order (Module B) id and its associated objects. I was able to drastically reduce the unnecessary DB hits depends on the number of objects selected in bulk operation.
Guess What!! I saved the day. That’s what I thought when I realized the local cache didn’t fully solved the issue, when the users’ of an org distributed and pursuing the operation. Thankfully I was able to identify the issue before shipping the solution to Production by implementing the solution with Redis.
Phase #3: (Final Solution)
Extracted the Purchase Order (Module A) and Process Order (Module B) handling code from the Monolithic Financial Application System to a separate Micro-Service.

Have done end-to-end configuration from DB, Distributed Caching, AWS instance, BitBucket Code repo for the new PO (Module A & B)microservice.
Hurray! Its up and live. Tiny ideas, hard-work and well planned execution yields more than 70% of time Saving in Latency.
Results:

Happy Coding!!
— Ashok Chakravarthi