From ce7c68511b7ddf14ab86adaaf6cade51d0a78d24 Mon Sep 17 00:00:00 2001
From: akastijn <akastijn@alttd.com>
Date: Sun, 2 Aug 2026 18:43:12 +0200
Subject: [PATCH] Validate sender UUID in `sendServerMessage` to prevent
 spoofing and enhance security.

---
 .../controllers/chat/ServerMessageController.java   | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/backend/src/main/java/com/alttd/altitudeweb/controllers/chat/ServerMessageController.java b/backend/src/main/java/com/alttd/altitudeweb/controllers/chat/ServerMessageController.java
index 2f35041..2c278ba 100644
--- a/backend/src/main/java/com/alttd/altitudeweb/controllers/chat/ServerMessageController.java
+++ b/backend/src/main/java/com/alttd/altitudeweb/controllers/chat/ServerMessageController.java
@@ -1,6 +1,7 @@
 package com.alttd.altitudeweb.controllers.chat;
 
 import com.alttd.altitudeweb.api.ServerMessageApi;
+import com.alttd.altitudeweb.controllers.data_from_auth.AuthenticatedUuid;
 import com.alttd.altitudeweb.model.ServerMessageRequestDto;
 import com.alttd.altitudeweb.services.chat.to_server.ServerMessageService;
 import com.alttd.altitudeweb.services.chat.to_server.data.ChatFromWeb;
@@ -11,6 +12,9 @@ import lombok.extern.slf4j.Slf4j;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.ResponseEntity;
 import org.springframework.web.bind.annotation.RestController;
+import org.springframework.web.server.ResponseStatusException;
+
+import java.util.UUID;
 
 @Slf4j
 @RestController
@@ -19,6 +23,7 @@ public class ServerMessageController implements ServerMessageApi {
 
     private final ServerMessageService serverMessageService;
     private static final ObjectMapper OBJECT_MAPPER = new ObjectMapper();
+    private final AuthenticatedUuid authenticatedUuid;
 
     public static String toJson(Object object) {
         try {
@@ -30,13 +35,19 @@ public class ServerMessageController implements ServerMessageApi {
 
     @Override
     public ResponseEntity<Void> sendServerMessage(String server, ServerMessageRequestDto serverMessageRequestDto) {
+        UUID authenticatedUserUuid = authenticatedUuid.getAuthenticatedUserUuid();
+
+        if (!authenticatedUserUuid.equals(serverMessageRequestDto.getUuid())) {
+            throw new ResponseStatusException(HttpStatus.FORBIDDEN, "Cannot send message as another user");
+        }
+
         ChatFromWeb chatFromWeb = ChatFromWeb.builder()
                 .sender(serverMessageRequestDto.getUuid())
                 .message(serverMessageRequestDto.getMessage())
                 .build();
 
         String json = toJson(chatFromWeb);
-
+        //TODO [Stijn] [2026-08-02]: Validate the user can send a message in this server (or do that in chat)
         if (serverMessageService.sendMessage(server, "web_chat", json)) {
             return new ResponseEntity<>(HttpStatus.ACCEPTED);
         } else {