HAPI FHIR endpoint discovery needs an authorization test

HAPI FHIR, an open-source implementation of the HL7 FHIR standard, faces security concerns regarding its endpoint discovery process. The API's authentication and authorization mechanisms determine whether a server reveals patient data, based on resource-level access policies. A simple search using the app title "HAPI FHIR" yielded different results: zero matches for a specific observation, but 2,300 matches when searching with the "all" sub_type, page 1, and a page size of 1. This discrepancy highlights the importance of testing endpoint authorization thoroughly.

To ensure proper security, analysts should use unauthenticated clients, clients with limited patient or resource scopes, and clients with administrative roles. They should also examine the server's response to known synthetic resources, resources outside the token's scope, and broad searches. It is crucial to record the HTTP status, returned resource types, bundle totals, and whether errors reveal resource existence.

Production environments must implement transport security, client/user authentication, and access control according to HL7's FHIR security guidance. Testing should be consistent and cover various scenarios, including self-hosted servers, servers using mutual TLS or reverse proxies, and servers with self-hosted test identity providers. It is essential to separate test data from clinical data and verify that the issuer, audience, signing key, token expiry, and client registration are correctly configured.

Ultimately, the primary concern is whether a specific endpoint enforces authentication and resource-level authorization. HAPI FHIR provides the API, but the deployment's security layer determines the actual access decisions.