OeditusCredo.Check.Security.IncorrectAuthorization
(OeditusCredo v0.6.2)
View Source
Basics
This check is disabled by default.
Learn how to enable it via .credo.exs.
This check has a base priority of high and works with any version of Elixir.
Explanation
Detects potentially incorrect authorization order (CWE-863).
Authorization should be checked BEFORE performing sensitive operations.
Bad:
Repo.delete!(post)
authorize!(user, :delete, post)Good:
authorize!(user, :delete, post)
Repo.delete!(post)Check-Specific Parameters
Use the following parameters to configure this check:
:exclude_test_files
Set to true to skip test files (default: false)
This parameter defaults to nil.
:extra_auth_indicators
Additional authorization indicator substrings to recognize (default: [])
This parameter defaults to nil.
General Parameters
Like with all checks, general params can be applied.
Parameters can be configured via the .credo.exs config file.