Profile API security

[ethanstrominger]

Overview

As a security admin I want to make sure that users can see and update only appropriate fields. get for profile api should return all fields except password. Patch should allow all fields except password, created_at, updated_at, is_staff, is_superuser, and is_active.

Action Items

• Implement as explained in technical details
• Add tests

Technical

Recommended approach:

• Create a ProfileSerializer that includes all fields except password and marks created_at, updated_at, is_active, is_superuser, is_staff, and uuid as read only.
• Disable post (requires googling) operation
• Create a view that uses the ProfileSerializer.
• Modify profile URL to point to this view.
• Tests
  • Verify response does not include password
  • Verify patching (updating) password gives an error
  • Verify patching created_at, updated_at, or uuid gives an error
  • Verify all other fields can be updated