Fix BOLA (Broken Object Level Authorization) in Astro
BOLA (formerly IDOR) is the apex predator of API vulnerabilities. In Astro's SSR and API routes, it occurs when you trust the 'id' parameter provided by the client without verifying if the authenticated user has the rights to access that specific resource. If you're querying your DB using only a user-supplied ID, you're wide open to horizontal privilege escalation.
The Vulnerable Pattern
import { db, Posts, eq } from 'astro:db';export const GET: APIRoute = async ({ params }) => { const { id } = params; // VULNERABILITY: Blindly trusting the ‘id’ from the URL. // Any logged-in (or anonymous) user can crawl this endpoint by incrementing IDs. const post = await db.select().from(Posts).where(eq(Posts.id, id)).get();
if (!post) return new Response(null, { status: 404 }); return new Response(JSON.stringify(post)); };
The Secure Implementation
The fix shifts the authorization logic from the 'perimeter' to the 'data layer'. Instead of just checking if a user is logged in, we enforce ownership within the SQL query itself. By using `and(eq(Posts.id, id), eq(Posts.authorId, user.id))`, the database will only return a result if the record belongs to the requester. If the record exists but belongs to someone else, the query returns null, and we issue a 404. This pattern effectively kills BOLA by making object-level access dependent on the session identity, not just the URL structure.
import { db, Posts, eq, and } from 'astro:db';export const GET: APIRoute = async ({ params, locals }) => { const { id } = params; const user = locals.user; // Populated by your auth middleware (e.g., Lucia, Auth.js)
if (!user) { return new Response(‘Unauthorized’, { status: 401 }); }
// FIX: Scope the query to BOTH the object ID and the authenticated User ID. // This ensures a user can only retrieve records they actually own. const post = await db.select() .from(Posts) .where( and( eq(Posts.id, id), eq(Posts.authorId, user.id) ) ).get();
if (!post) { // Return 404 instead of 403 to prevent ID enumeration/probing. return new Response(‘Not Found’, { status: 404 }); }
return new Response(JSON.stringify(post)); };
Your Astro API
might be exposed to BOLA (Broken Object Level Authorization)
74% of Astro apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.