dmvcframework-security

DMVCFramework — Secure coding reference

This is a reference for the other DMVCFramework skills. Whenever you write an endpoint that accepts input from a client — a controller action, a minimal-API handler, a web page, a filter — the controls below apply. They are not optional extras.

Adapted from the OWASP-style VibeSec secure-coding guide (Apache-2.0), rewritten against the real DMVCFramework API: every class, attribute and filter named here was verified in sources/.

The rule that catches most of it: never trust anything that arrived over the wire — not the body, not the query string, not a header, not a cookie, not a filename, not a URL, not a JWT you have not verified.

---

When in doubt about an API — verify it, never guess

Never invent an identifier or answer from memory. If you need a signature this skill does not cover, ask the user for the path to their DelphiMVCFramework checkout and read sources/ (and the matching samples/ project); failing that, read the official repository — sources · samples. If you still cannot verify it, say so. Where a skill and a sample disagree, the sample wins.

---

1. Access control — the #1 cause of real breaches

Authentication says who you are. Authorization says what you may touch. Do not confuse them: a valid JWT is not permission to read row 42.

The IDOR trap. This is the single most common serious bug in a CRUD API:

// BROKEN — any authenticated user can read anyone's order
function TOrdersController.GetOrder(const ID: Integer): IMVCResponse;
begin
  Result := OKResponse(TMVCActiveRecord.GetByPK<TOrder>(ID));
end;

The ID comes from the URL. Nothing ties it to the caller. Scope every lookup to the authenticated principal, in the query — not with an if after the fact: