Fix BFLA (Broken Function Level Authorization) in Hapi

BFLA occurs when your API assumes 'authenticated' equals 'authorized'. In Hapi, exposing administrative functions to standard users without explicit role-based access control (RBAC) is an invitation for attackers to escalate privileges. If you aren't validating scopes or roles at the route level, your backend is wide open.

The Vulnerable Pattern

server.route({
  method: 'DELETE',
  path: '/api/admin/config',
  options: {
    auth: 'jwt' // VULNERABLE: Only checks if the token is valid, not the user's permissions
  },
  handler: async (request, h) => {
    await db.config.drop();
    return { success: true };
  }
});

The Secure Implementation

The fix involves utilizing Hapi's built-in 'scope' validation within the route options. When your authentication strategy (e.g., hapi-auth-jwt2) decodes a token, it should populate 'request.auth.credentials.scope' with the user's roles. By defining 'scope: ["admin"]' on the route, Hapi automatically returns a 403 Forbidden before the handler code is ever executed if the user lacks the required permission. This prevents function-level bypasses.

server.route({
  method: 'DELETE',
  path: '/api/admin/config',
  options: {
    auth: {
      strategy: 'jwt',
      scope: ['admin'] // SECURE: Hapi internal ACL checks for 'admin' scope in the credentials
    }
  },
  handler: async (request, h) => {
    await db.config.drop();
    return { success: true };
  }
});