Broken Object Level Authorization (BOLA / IDOR) in Node.js & Express

Eliminate BOLA (CWE-639) / IDOR vulnerabilities in Node.js, Express, and Prisma by binding database lookups directly to authenticated tenant session context.

💡 Explicación en Lenguaje Sencillo (ELI5)

Imagine checking into Room 204 at a hotel and receiving a valid keycard. But you discover that if you scratch out '204' on the door handle and write '205', the lock clicks open and allows you to rummage through another guest's luggage. The hotel confirmed you were a registered guest (authentication), but never checked whether your key matched Room 205 (object authorization). In BOLA/IDOR, an attacker changes an ID in an API request and accesses another user's private records.

Conceptos Clave y Términos

Authentication vs. Authorization: Authentication confirms who the user is. Authorization verifies if that user has permission to access that specific object.
BOLA (OWASP API #1): Broken Object Level Authorization: accessing unauthorized records by manipulating object IDs.
Tenant Binding: Ensuring queries filter by both resource ID and the authenticated user's organization.

Flujo de Ataque Paso a Paso

Step 1

Session Authentication

User logs in and receives a valid session or JWT.

Step 2

ID Manipulation

User changes URL parameter from /api/documents/100 to /api/documents/101.

Step 3

Unscoped Query

Express handler queries Prisma with only the document ID.

Step 4

Cross-Account Leakage

Server returns document belonging to another organization.

Código Fuente: Vulnerable vs. Seguro

✕ IMPLEMENTACIÓN VULNERABLE

// VULNERABLE: Queries document by user-supplied ID alone
app.get('/api/documents/:id', authenticateJWT, async (req, res) => {
  // Vulnerable: trusts req.params.id without verifying organization ownership
  const document = await prisma.document.findUnique({
    where: { id: req.params.id }
  });
  
  if (!document) {
    return res.status(404).json({ error: 'Document not found' });
  }
  
  // Attacker accesses documents belonging to any tenant!
  res.json(document);
});

✓ PARCHE SEGURO Y ROBUSTO

// HARDENED: Scopes query strictly to authenticated user's tenant organization
app.get('/api/documents/:id', authenticateJWT, async (req, res) => {
  // Defense-in-depth: findFirst filters by BOTH document ID and authenticated tenant
  const document = await prisma.document.findFirst({
    where: {
      id: req.params.id,
      organizationId: req.user.organizationId
    }
  });
  
  if (!document) {
    // Return 404 rather than 403 to prevent object enumeration
    return res.status(404).json({ error: 'Document not found' });
  }
  
  res.json(document);
});

Lista de Verificación de Seguridad para Ingeniería

✓Nunca use findUnique with only a client-supplied ID in multi-tenant APIs.
✓Utilice siempre findFirst with both ID and the authenticated user's organizationId.
✓Práctica de seguridad recomendada: Return 404 instead of 403 on authorization failure to prevent ID enumeration.
✓Utilice siempre random UUIDv4 identifiers rather than auto-incrementing integer IDs.