Authentication tells your API who sent a request. It does not tell you whether that sender may touch the record named in the request. If an endpoint takes an ID from the URL, query string, or body and uses it to load data without checking that the caller is entitled to that specific object, a signed-in user can often read or change someone else’s data simply by editing the ID. The fix is a rule you apply to every caller-supplied identifier: treat it as a claim that must be verified against trusted server-side scope before it is allowed to become a query input.
Why a valid login is not enough
Most API teams already have authentication: a session cookie, an OAuth access token, or an API key that identifies the caller. The gap is the step after that. Knowing that a request came from user 1182 says nothing about whether user 1182 may see household 7741, invoice 90315, or message 5520. Those are separate questions, and an endpoint that answers only the first one is vulnerable.
As an Amazon Associate I earn from qualifying purchases.
OWASP names this failure Broken Object Level Authorization (BOLA) and lists it first in the OWASP API Security Top 10 (2023 edition, item API1:2023). The OWASP guidance states the requirement directly:
“Every API endpoint that receives an ID of an object, and performs any action on the object, should implement object-level authorization checks.”
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
The rule covers reads, updates, deletes, and any other action. It also covers every format of ID. Sequential integers, UUIDs, and opaque strings all identify objects. Unguessable UUIDs make enumeration harder, but they are not an authorization decision: a leaked or shared UUID still names a record, and the server still has to decide whether this caller may use it.
The engineering rule: authorize the ID before it becomes a query
As Ivan Rossouw puts it in “Treat Every ID as an Authorization Claim”: “A useful engineering rule is to treat every caller-supplied identifier as an authorization claim before treating it as a query input.” In practice, the question for each endpoint is:
May this caller name the record represented by this identifier, for this action?
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →The answer has to come from server-side state the client cannot alter. A request body saying “my account” is not that state. An ID in the path is not that state. The server must derive the caller’s scope from authenticated identity and stored relationships, then check the supplied IDs against that scope.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Implementation order
The sequence below keeps the authorization decision next to the data boundary, rather than scattering it across handlers, repositories, mappers, and front-end code where it is easy to miss on one path.
- Identify the caller from trusted authentication state. Use the verified token or session on the server. Never accept a user ID or role from the request payload as identity.
- Resolve authoritative scope. Load the records and relationships that define what this caller may access: the accounts they belong to, the households they are a member of, the roles they hold, and any delegated grants.
- Evaluate every supplied ID against that scope. Check each ID in the path, query string, and body that refers to an object, and check it for the specific action requested. Reading an invoice and deleting an invoice can require different rules.
- Reject any ID outside scope. Do not continue with a partial or substituted value.
- Construct and execute the query using only the authorized scope. The query should be built from the verified scope, not from the raw IDs that passed through the check.
Evaluate each ID independently
A parent ID that passes does not authorize a child ID. Consider a route such as GET /households/7741/records/90315. The caller may be a valid member of household 7741, but record 90315 may belong to a different household. The check must confirm that record 90315 is inside the caller’s scope, not merely that the parent path segment looks correct.
The same applies in reverse. A malformed or unauthorized filter must not erase the boundary that another ID establishes. In a request with two identifiers where only one is valid, the request should be refused, not executed with the valid part and the other part quietly dropped. The example below shows the shape of the check.
// Trusted state, resolved from the verified session, never from the request
const caller = await auth.requireUser(request);
const memberHouseholdIds = await memberships.householdIdsFor(caller.id);
// Each caller-supplied ID is a claim, checked before it reaches a query
const householdId = parseId(request.params.householdId);
if (!memberHouseholdIds.includes(householdId)) {
return reject(); // refuse; do not fall back to a different household
}
const recordId = parseId(request.params.recordId);
const record = await records.findOne({
id: recordId,
householdId: { in: memberHouseholdIds } // scope in the query, not only the check
});
if (!record) return reject();Scoping the query as well as checking the ID is a defense in depth: if the check and the query ever drift apart, the query still refuses records outside the caller’s scope.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Email is not an ownership rule
It is tempting to match a caller’s email address to a record’s contact field and treat that as ownership. Email is not reliable for this. Addresses may be corrected, reused by someone else after being released, shared within a family or team, copied into contact lists, or retained on records after an account has changed hands. Using equality on email as a silent ownership rule grants access that the business never decided to grant.
During a migration, email can help you find candidate links between old accounts and people. Treat those matches as suggestions for review, and store an explicit account-to-person relationship that the server can verify. Only that stored relationship should drive authorization.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Legacy clients: reject by default, narrow only by exception
For ordinary data-specific routes, the recommended response to a cross-scope ID is rejection. A rejection is clear, visible in logs and tests, and forces the caller to fix the request. Some older clients, however, react badly to a forbidden response and fail in ways that break a user journey. In those cases a team may consider compatibility-preserving narrowing: the server removes the unauthorized filter and returns only what the caller is allowed to see.
Narrowing is a migration exception, not a pattern. Its safety rests on one invariant: removing an unauthorized filter must never expand the response into protected data. If you cannot prove that, do not narrow.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
| Consideration | Strict rejection | Compatibility-preserving narrowing |
|---|---|---|
| Boundary clarity | The boundary is explicit: a cross-scope ID is refused. | The boundary is blurred: the request succeeds with a silently changed result. |
| Misuse visibility | Misuse appears as refused requests that logs and monitoring can count. | Misuse can look like normal traffic; it needs dedicated telemetry to surface. |
| Client compatibility | Older clients may fail visibly on a refused request. | Older clients keep working, which is the reason the exception exists. |
| Assurance that the safe baseline cannot widen access | Not needed for the refusal path, since no data is returned. | Required: the named safe baseline must guarantee the result stays inside protected scope. |
| Test and telemetry burden | Standard cross-account and cross-household tests. | Additional tests of the narrowed result, plus telemetry that avoids logging sensitive identifiers. |
| Removal condition | Not applicable. | Must be written down. Without one, the exception becomes permanent. |
If you do use narrowing, keep it endpoint-specific and record the following:
- Why the exception exists, which client versions depend on it, and the date it was approved.
- The named safe baseline, such as a membership-scoped result set, that guarantees the narrowed response cannot include protected records.
- Telemetry that counts exception hits without storing raw sensitive identifiers.
- A concrete removal condition, such as a client version reaching end of support, with an owner responsible for removing it.
Do not compensate for a missing scope by substituting a different household, guessing from a weak attribute such as a name or postal code, or running an unscoped query and filtering afterward.
Test the data, not only the status code
A 200 response does not prove safety. A successful status can still carry records from another household if a filter was dropped. Assert the returned data in every authorization test. Cover at least these cases:
Free tools Windows power users keep installed
One-click scans. No signup required.
- The caller reading their own authoritative records.
- Related child records reached through a valid parent, and child records under a different parent.
- Another household’s records, with the response body checked for any leaked fields.
- Missing or revoked relationships, where the caller should lose access.
- Shared or copied email addresses that must not grant ownership.
- Staff roles without the required permission, and the same role with the exact permission.
- Mixed filters where only one ID is valid.
- Legacy request shapes that older clients still send, including any narrowed exception paths.
For each case, assert both the HTTP status and the exact set of object IDs in the response. The second assertion is the one that catches silent widening.
Quick Recap
“
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
