You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@fineract.apache.org by "priyam99 (via GitHub)" <gi...@apache.org> on 2026/10/12 19:50:32 UTC
[PR] Return HTTP 404 when a customer accesses another customer's application [fineract-loan-origination]
priyam99 opened a new pull request, #170:
URL: https://github.com/apache/fineract-loan-origination/pull/170
## Description
When a customer asks for an application that belongs to someone else, the ownership check correctly blocks it, but the API answers with a 500. Besides looking like a server crash, that also gives something away: a reference that doesn't exist comes back as 404, so a 500 tells you the application is real and just isn't yours. Since references are sequential (`LOS-2026-00001`, `00002`, …), that's enough to probe for other customers' applications.
The cause is in `CustomerLoanApplicationController.assertOwnedByCaller()`. It throws `AccessDeniedException`, which `GlobalExceptionHandler` doesn't handle, so it ends up in the catch-all 500.
I changed it to throw `ApplicationNotFoundException`, the same exception the service throws when a reference doesn't exist. A non-owner now gets exactly the same 404 and message as for a missing application, so the two can't be told apart. No new handler was needed, since that exception already maps to 404. This is also what `docs/api/rest-api.adoc` already promises: "Returns `404` if not found or owned by a different customer."
The same check guards three endpoints, so all of them are covered: application details, credit score, and submit. The issue only mentions the first two, but submit had the same problem.
I kept this separate from #159 on purpose. Once ownership failures stop using `AccessDeniedException`, mapping that exception to 403 in #159 can't accidentally turn these into 403s and leak the same information.
Closes #160
## Verification
I ran `./mvnw spotless:apply`, `./mvnw apache-rat:check` and the full `./mvnw clean verify` with Docker running. Everything passes: 196 unit tests and 7 Cucumber scenarios.
New tests in `CustomerLoanApplicationControllerTest` (MockMvc with the real service and a logged-in customer, only the repositories mocked):
- the owner can view their application and its credit score (200)
- another customer gets 404 with no application data for details and credit score, and the score is never read
- another customer gets 404 trying to submit it, and it stays `DRAFT`
- the 404 another customer gets is the same as the 404 for a reference that doesn't exist
With the fix taken out, the four "another customer" tests fail with 500.
I also ran the app locally (dev profile, mock Fineract) with two customers, Alice and Bob. Alice created `LOS-2026-00001` and Bob tried to read it.
Before:
```
$ curl -H 'Authorization: Bearer <bob>' .../api/v1/customer/loan-applications/LOS-2026-00001
{"error":"Internal Server Error","message":"An unexpected error occurred.","status":500,...}
HTTP 500
$ curl -H 'Authorization: Bearer <bob>' .../api/v1/customer/loan-applications/LOS-2026-99999
{"error":"Not Found","message":"No loan application found with reference [LOS-2026-99999] for tenant [default].","status":404,...}
HTTP 404
```
After:
```
$ curl -H 'Authorization: Bearer <bob>' .../api/v1/customer/loan-applications/LOS-2026-00001
{"error":"Not Found","message":"No loan application found with reference [LOS-2026-00001] for tenant [default].","status":404,...}
HTTP 404
$ curl -H 'Authorization: Bearer <bob>' .../api/v1/customer/loan-applications/LOS-2026-00001/credit-score
HTTP 404 (same body)
$ curl -X POST -H 'Authorization: Bearer <bob>' .../api/v1/customer/loan-applications/LOS-2026-00001/submit
HTTP 404 (same body)
$ curl -H 'Authorization: Bearer <alice>' .../api/v1/customer/loan-applications/LOS-2026-00001
HTTP 200 (owner still works, status still DRAFT after Bob's submit attempt)
```
No frontend changes.
One thing I noticed but left out of scope: if an application somehow has no applicant profile, the ownership check fails with a different "profile not found" 404 before the comparison runs. That shouldn't happen with normal data, so I didn't change it here.
## AI assistance (optional)
- Tool / model: Claude Code (Claude Opus 5.5)
- How it was used: helped me trace the ownership check, draft the change and tests, and run the build and the local before/after check. I reviewed every line before pushing.
## Checklist
- [x] This PR is one logical change, not a code dump.
- [x] I added or updated tests, or explained why tests are not needed.
- [x] New files carry the ASF license header.
- [x] Docs are updated. (Nothing to change; the API docs already say 404 for this case.)
- [x] All commits are signed.
- [x] I followed the [AI Policy](https://github.com/apache/fineract/blob/develop/CONTRIBUTING.md#ai-policy) and the [ASF Generative Tooling Guidance](https://www.apache.org/legal/generative-tooling.html).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@fineract.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Return HTTP 404 when a customer accesses another customer's application [fineract-loan-origination]
Posted by "Aman-Mittal (via GitHub)" <gi...@apache.org>.
Aman-Mittal merged PR #170:
URL: https://github.com/apache/fineract-loan-origination/pull/170
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@fineract.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Return HTTP 404 when a customer accesses another customer's application [fineract-loan-origination]
Posted by "KRYSTALM7 (via GitHub)" <gi...@apache.org>.
KRYSTALM7 commented on code in PR #170:
URL: https://github.com/apache/fineract-loan-origination/pull/170#discussion_r4255584230
##########
src/test/java/org/apache/fineract/los/api/CustomerLoanApplicationControllerTest.java:
##########
Review Comment:
Nice regression coverage here: asserting that the credit-scoring service is never called verifies the rejection happens before sensitive score data is accessed. Together with the owner-access and submit-state tests, this gives good coverage of the main security boundary.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@fineract.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Return HTTP 404 when a customer accesses another customer's application [fineract-loan-origination]
Posted by "KRYSTALM7 (via GitHub)" <gi...@apache.org>.
KRYSTALM7 commented on code in PR #170:
URL: https://github.com/apache/fineract-loan-origination/pull/170#discussion_r4255578368
##########
src/main/java/org/apache/fineract/los/api/CustomerLoanApplicationController.java:
##########
@@ -157,7 +157,10 @@ private void assertOwnedByCaller(
final Long ownerClientId = loanApplicationService.getFineractClientIdOrThrow(application);
if (!ownerClientId.equals(principal.getClientId())) {
- throw new AccessDeniedException("Application does not belong to this customer");
Review Comment:
Good choice to use "ApplicationNotFoundException" specifically for this ownership check rather than changing global "AccessDeniedException" handling. This keeps the anti-enumeration behavior scoped to customer-owned applications and avoids conflicting with the separate 403 fix in #159.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@fineract.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Return HTTP 404 when a customer accesses another customer's application [fineract-loan-origination]
Posted by "priyam99 (via GitHub)" <gi...@apache.org>.
priyam99 commented on code in PR #170:
URL: https://github.com/apache/fineract-loan-origination/pull/170#discussion_r4266101754
##########
src/main/java/org/apache/fineract/los/api/CustomerLoanApplicationController.java:
##########
@@ -157,7 +157,10 @@ private void assertOwnedByCaller(
final Long ownerClientId = loanApplicationService.getFineractClientIdOrThrow(application);
if (!ownerClientId.equals(principal.getClientId())) {
- throw new AccessDeniedException("Application does not belong to this customer");
Review Comment:
Thanks! I kept it to this one check so #159 can handle the 403 case separately. I'm planning to pick up #159 next.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@fineract.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Return HTTP 404 when a customer accesses another customer's application [fineract-loan-origination]
Posted by "priyam99 (via GitHub)" <gi...@apache.org>.
priyam99 commented on PR #170:
URL: https://github.com/apache/fineract-loan-origination/pull/170#issuecomment-6196502753
@Aman-Mittal when you have a moment, could you take a look at this one? It's approved by @KRYSTALM7 and checks are green.
I've also opened #172 for issue #159 (403 for authorization failures). It's based on `main` and touches different files from this PR, so the two don't conflict.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@fineract.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org