auditing-grpc-service-authorization

Auditing gRPC service authorization: the method the interceptor does not cover

A gRPC service usually centralizes authorization in an interceptor, and the bug is a method the interceptor does not actually cover. The classic shape is an auth interceptor installed on the unary chain while the streaming chain runs without it, so a streaming RPC is callable with no credentials. You audit it by resolving which interceptors are registered and which methods and stream types they actually gate, then checking each method the check assumes is covered. The other half is the channel: a plaintext or insecure channel, metadata trusted without verification, missing message and recursion limits, and a transcoding gateway that fronts the service without the same auth filter. Certificate-validation mechanics belong to the transport skill; this skill owns whether a reachable method is authorized.

When to use

• You are reviewing a gRPC server's service registration, interceptor chain, and method handlers.
• The service enforces authorization in an interceptor, or is fronted by a transcoding gateway.
• You want to know whether a caller can reach a method without the authorization the service assumes.

Scope check

Audit only services you own or are authorized to assess, and call a method only against an endpoint in scope, an unauthorized RPC drives real service state. Adjudicate on the registration and the handlers. If you can't name the authorization, stop.

The loop

1. Resolve the interceptor coverage and channel credentials first. Enumerate the registered interceptors and determine, for each, whether it applies to the unary chain, the streaming chain, or both, and read the channel setup for whether it requires transport credentials or runs insecure. A method's authorization lives in whatever interceptor actually wraps it, so establish that coverage map before judging any individual handler.

2. Check the unary-versus-streaming gap. Look for an authorization interceptor installed on the unary interceptor while the streaming interceptor chain omits it (or the reverse), so a whole class of RPCs runs without the check that the unary methods enforce.