Enhanced Security Defaults for Credential-based Access Control

[Abrom8]

Enhanced Security Defaults for Credential-based Access Control

Issue

For sensitive data scenarios, legal requirements may restrict access only to qualified individuals (e.g., credentialed EU researchers).

There lacks a secure default for when the credentials configuration is not explicitly defined, potentially allowing unintended access.

Proposed Change

Enhance the credentials configuration by adding an allowAll field and implementing secure defaults:

• Add allowAll Field: A boolean to explicitly allow or deny access to everyone if no specific allow or deny credentials are defined.
• Default Behavior:
  • allowAll: false
  • If the credentials object is undefined or if allowAll is false/undefined and no allow credentials are specified, no access is granted.
• defined allow and deny policies overrule the allowAll configuration

Example Object with Default Secure Settings

{
  "credentials": {
    "allowAll": false,
    "allow": [],
    "deny": []
  }
}