Fix BOLA (Broken Object Level Authorization) in Chi

BOLA (Broken Object Level Authorization) remains the #1 threat in the OWASP API Top 10. In the context of Go's Chi router, BOLA occurs when an endpoint trusts a user-supplied identifier (like a UUID or ID in the URL) without verifying that the authenticated user actually has the rights to access that specific resource. If you're just grabbing a URL param and hitting the DB, you're likely vulnerable.

The Vulnerable Pattern

func GetOrder(w http.ResponseWriter, r *http.Request) {
	// VULNERABLE: Direct reference to ID without ownership check
	orderID := chi.URLParam(r, "orderID")
	var order Order
	if err := db.First(&order, "id = ?", orderID).Error; err != nil {
		http.Error(w, "Order not found", 404)
		return
	}
	render.JSON(w, r, order)
}

The Secure Implementation

The vulnerability lies in the 'Insecure Direct Object Reference'. In the vulnerable snippet, any authenticated user can change the 'orderID' in the URL to access any order in the database. The fix involves two steps: 1. Extracting the requester's identity from a secure source (like a JWT claims object stored in the request context by middleware). 2. Scoping the database query to include both the Resource ID and the Owner ID. By adding 'AND user_id = ?' to the query, you ensure the database only returns records belonging to the requester. Additionally, returning a 404 instead of a 403 prevents attackers from confirming the existence of IDs they do not own.

func GetOrderSecure(w http.ResponseWriter, r *http.Request) {
	// SECURE: Extract UserID from context (populated by Auth middleware)
	userID, ok := r.Context().Value("userID").(string)
	if !ok {
		http.Error(w, "Unauthorized", 401)
		return
	}
orderID := chi.URLParam(r, "orderID")
var order Order

// Enforce ownership at the query level
if err := db.First(&order, "id = ? AND user_id = ?", orderID, userID).Error; err != nil {
	// Return 404 to avoid ID enumeration/discovery
	http.Error(w, "Order not found", 404)
	return
}
render.JSON(w, r, order)
}