Insecure custom authentication
Authentication is difficult to get right, and Mendix offers several places to replace or extend it. A custom mechanism that is subtly wrong does not fail loudly; it simply lets the wrong person in, or lets the right person skip a step that was there for a reason.
How this shows up in a Mendix application.
A session active too early
The session starts before every step has passed, which is exactly how multi-factor authentication gets skipped.
Authentication in a navigation microflow
Login logic in the flow that renders the page, running inside a session that already exists rather than an anonymous one.
The standard login left reachable
The custom path is added but the platform login still works, so the new behaviour is optional for anyone who knows the URL.
Tokens validated only on identity
A JWT or SAML assertion is read for who it claims to be, while expiry, issuer, audience and signature go unchecked.
Identity from claims the user controls
Mapping the account from a value the user can influence, which turns identification into a text field.
No brute-force protection
One-time codes and custom password checks with no lockout, so guessing is a matter of patience.
What it lets someone do.
Every item below has been found in production applications. None of them requires a sophisticated attacker: they require somebody who reads the page source, edits a request or simply logs in.
How to keep it out.
Do not invent, and do not rebuild
Use maintained Marketplace modules or standard libraries rather than implementing a protocol by hand.
Finish authenticating before the session starts
All steps complete with no session or an anonymous one, and the standard login listener replaced so the custom path cannot be sidestepped.
Validate every claim, rotate every secret
Expiry, issuer, audience and signature, with cryptographically strong keys that differ per environment.
What Omnext checks for you.
Omnext finds the places where authentication is customised, from published integrations to request handlers and login listeners, and reports where a session becomes active before the flow has finished.
The framework is The S-Unit's.
The S-Unit Top 10 is the work of The S-Unit, the Mendix security specialists. They built it from more than ten years of offensive security work and hundreds of Mendix penetration tests, and they maintain the canonical version. Omnext automates the checks in the Security Analysis module; the framework itself is theirs, and this page explains it in our own words.
Which of the ten are you sure about?
Ten questions, about four minutes, results on screen. Or let the scan answer all ten with evidence from your own model.