How to fix BOLA (Broken Object Level Authorization)
in .NET 8 Web API

The fix involves shifting from 'Does this user have a valid token?' to 'Does this user own this specific record?'. In the secure snippet, we leverage the NameIdentifier claim from the ClaimsPrincipal. Instead of fetching by ID and checking ownership in memory, we bake the ownership check directly into the SQL query using FirstOrDefaultAsync. This prevents data leakage and side-channel timing attacks. For complex enterprise apps, implement a custom IAuthorizationHandler to centralize this logic using Resource-Based Authorization.

[Authorize]
[HttpGet("api/invoices/{id}")]
public async Task GetInvoice(int id)
{
    // Extract the User ID from the JWT claims
    var userId = User.FindFirst(ClaimTypes.NameIdentifier)?.Value;
// SECURE: Query filter ensures the record belongs to the current user
var invoice = await _context.Invoices
    .FirstOrDefaultAsync(i => i.Id == id && i.OwnerId == userId);

if (invoice == null) 
{
    // Return NotFound instead of Unauthorized to prevent ID enumeration
    return NotFound();
}

return Ok(invoice);
}