c# - Document sniffing via Load<>? -

i'm using ravendb asp.net web api , i've noticed, it's possible query other documents load<type> method.

for example:

public class person {     public string id { get; set; }     public string fullname { get; set; }     /* other properties */ }  public class pet {     public string id { get; set; }     public string fullname { get; set; } }  [httpget] public person findbyid(string id) {     using (idocumentsession session = _docstore.opensession())     {         return session.load<person>(id);     } } 

if call findbyid("pets/13") via ajax on web api method, i'm getting person object pet's entity data, because share common properties. how can avoid that? expose confidential data attackers.

even if properties don't match, object null properties returned exposing existance of entity given id.

my current workaround is:

[httpget] public person findbyid(string id) {     using (idocumentsession session = _docstore.opensession())     {         return session.load<person>("people/" + id.split('/')[1]);     } } 

ids unique across documents. don't abuse that: you're calling session.load<person>, you're passing in id pet. don't that.

internally, raven doing this:

1. "find json document id = 'pets/13'"
2. got it! now, turn json document into...uh...the developer asked person.
3. it kinda-sorta works person. return that, since developer told to.

basically, told raven return person, , did best could, turning pet json document person object, told do.

if you're concerned of malicious use of findbyid method, throw exception if id isn't person object:

[httpget] public person findbyid(string id) {     // we're concerned might call findbyid , fish non-person objects.     if (!id.startswith("people/"))     {         throw new argumentexception("naughty!");     }      using (idocumentsession session = _docstore.opensession())     {         return session.load<person>(id);     } }