This lesson's interactive features are locked, please to keep using them

Preventing Broken Access Control

Authentication answers the question, "Who are you?" Authorization answers "What are you allowed to do?"

Broken access control happens when the server forgets to ask that second question. It's usually a careless mistake, not some clever Linux-kernel exploit:

A route checks that you're logged in, but not what you can access.
A route trusts a role specified by the client.
A route uses an ID provided in the URL, but never verifies the user owns that resource.

The Rule of Thumb

Every protected action needs a server-side permission check. Not in the UI. Not in the mobile app. Not in a hidden form field. On the server. On every request.

A secure endpoint does two things, in order:

This endpoint has a problem:

app.get("/api/documents/:id", requireAuth, async (req, res) => {
  const doc = await db.documents.findById(req.params.id);
  if (!doc) return res.status(404).json({ error: "Not found" });
  res.json(doc);
});

It checks that the user is logged in, but it lets any logged-in user see any document just by changing the ID in the URL!

To fix it, add a doc.ownerId !== req.user.id check. If the document belongs to another user, return a 404 Not Found response:

app.get("/api/documents/:id", requireAuth, async (req, res) => {
  const doc = await db.documents.findById(req.params.id);
  if (!doc || doc.ownerId !== req.user.id) {
    return res.status(404).json({ error: "Not found" });
  }

  res.json(doc);
});

Returning the same 404 Not Found response for missing and unauthorized documents also avoids confirming that another user's document exists. A 403 Forbidden response is fine when it's not sensitive that a resource exists, but a 404 reveals even less here.

How Attackers Find These Bugs

Attackers don't need clever exploits. They try the obvious things and see what the server lets through:

Calling endpoints directly
Changing IDs in the URL
Repeating requests with small variations

If the server doesn't enforce permissions, an attacker will eventually find something that works.

Assignment

The order-detail route returns any order whose ID appears in the URL. Enforce order ownership on the server.

Reset the database and start the app:
```
npm run db:reset
npm run dev
```
Log in as Mabel and confirm /orders/5 exposes Samson Carrasco's order.
In src/routes/orders.ts, update GET /orders/:id to return 404 Order Not Found if the order doesn't exist or it belongs to another user.
Confirm Mabel now sees Order Not Found at /orders/5 and can still view her own order at /orders/1.

With Bearly Secure still running, run and submit the CLI tests from the project root.