Identity and Trust — Authentication, Authorization, OAuth, JWT, SSO, and the OWASP World

The record that belonged to another clinic

Farhan had been at the health-tech startup in Hyderabad for eight months when the email arrived. The company built a patient records system for small clinics — the kind of two-doctor, one-receptionist clinics that are everywhere in Indian towns and that had, until recently, kept everything in paper files and a register. The product let a doctor pull up a patient's history, see past prescriptions, and add notes.

Farhan had built the feature that let a doctor open a patient record by patient ID. A doctor logged in, searched for a patient, clicked a name, and the record loaded. He had tested it thoroughly. A doctor who was not logged in could not see anything. A doctor who was logged in could see records. It worked. It shipped. He moved on to the next ticket.

Three weeks later, an administrator at one of the clinics sent an email to support. She had been helping a doctor who was curious about the system. The doctor had noticed that the patient record URL ended in a number. Out of idle curiosity, the doctor had changed the number by one. A different patient's record loaded. The doctor changed it again. Another record. These records belonged to patients at a different clinic entirely. The doctor had not bypassed a password. The doctor had not hacked anything. The doctor was correctly logged in the whole time. The system knew exactly who the doctor was.

The system had simply never asked whether this particular doctor was allowed to see this particular record.