Elevate API Call Permissions

Elevation lets you call restricted Wix API methods even when the current identity lacks the necessary permissions.

Elevate a method

Use the elevate() function from wix-auth:

When elevation is needed

Methods can be restricted based on user identity or roles and permissions:

• Identity-restricted methods can only be called by Wix users. For example, assignBadge() requires elevation when called outside a dashboard page, since site members can't assign badges to themselves.
• Role-restricted methods require specific roles. For example, confirmBooking() requires elevation when called on behalf of a user without an administrative Bookings role.

Security considerations

While elevation offers flexibility, it's crucial to consider how and when elevation is triggered. Web methods and HTTP functions are particularly vulnerable if not properly managed due to their open nature. Elevation in backend events or code only triggered from scheduled jobs presents less risk but should still be handled cautiously.

Example

To demonstrate how to properly handle elevation, consider a site that rewards frequent visitors with a special badge. To do so, the code needs to track recent member visits and call assignBadge() using elevation when a member has visited frequently enough. (Note that the code samples below have been simplified, removing error handling and other non-essential code.)

Here is an example of an insecure approach to writing this code:

There are several problems with the assignBadge() web method used in this approach:

• It is open for anyone to call, even though only members can receive badges.
• It doesn't ensure that it will only assign the intended badge.
• It doesn't ensure that it will assign a badge to the currently logged in member.

Because of these issues, this method can be called by a malicious user to assign any badge to any member.

You can easily remedy these issues by being more careful about where you use elevation and how you expose it to be called.

For example:

In this approach, the following makes sure the elevation is not exploited by malicious users:

• The ID of the badge to assign is specified in backend code.
• The current user ID is retrieved in backend code.
• The web method used to trigger the badge assignment has permissions set so it can only be called by site members.

See also

• About Identities
• Roles & Permissions
• elevate()