Fix BFLA (Broken Function Level Authorization) in RedwoodJS

Broken Function Level Authorization (BFLA) in RedwoodJS is a high-impact vulnerability where the application fails to verify if a user has the specific permissions required to execute a service function. In Redwood's architecture, developers often rely on the `@requireAuth` directive to ensure a user is logged in, but fail to implement granular Role-Based Access Control (RBAC) or ownership checks within the service layer. Attackers exploit this by directly calling GraphQL mutations with arbitrary IDs, bypassing frontend UI restrictions.

The Vulnerable Pattern

// api/src/services/posts/posts.js
// VULNERABLE: Only checks for authentication, not authorization.
export const updatePost = ({ id, input }) => {
  // Any logged-in user can update ANY post by providing a valid ID.
  // The @requireAuth directive in the SDL only ensures the user is logged in.
  return db.post.update({
    data: input,
    where: { id },
  })
}

The Secure Implementation

To kill BFLA in RedwoodJS, you must enforce authorization at the service level, not just the transport layer. First, use Redwood's SDL directives like `@requireAuth(roles: ['ADMIN'])` for functions that are strictly administrative. Second, for functions involving user-owned resources, perform a 'lookup-before-write' to verify that the `context.currentUser.id` matches the owner of the record being modified. Never trust the `id` provided in the GraphQL arguments without verifying the caller's relationship to that object. This ensures that even if an attacker discovers your internal GraphQL schema, they cannot manipulate data they do not own.

// api/src/services/posts/posts.js
import { forbiddenError } from '@redwoodjs/graphql-server'
export const updatePost = async ({ id, input }) => {
const post = await db.post.findUnique({ where: { id } })
if (!post) throw new Error(‘Post not found’)
// SECURE: Verify resource ownership or administrative role
const isOwner = post.userId === context.currentUser.id
const isAdmin = context.currentUser.roles?.includes(‘ADMIN’)
if (!isOwner && !isAdmin) {
throw new forbiddenError(“You do not have permission to update this post.”)
}
return db.post.update({
data: input,
where: { id },
})
}