Fix BOLA (Broken Object Level Authorization) in Go Fiber

BOLA (Broken Object Level Authorization) remains the top threat in the OWASP API Security Top 10. It occurs when an application relies on user-provided IDs to access resources without verifying if the requester actually owns or is authorized for that specific object. In the context of Go Fiber, this typically happens when a developer pulls a UUID or integer ID from `c.Params()` and executes a database query without an additional `WHERE` clause filtering by the authenticated user's ID.

The Vulnerable Pattern

app.Get("/api/orders/:id", func(c *fiber.Ctx) error {
    orderID := c.Params("id")
    var order Order
    // VULNERABLE: Only checks if the order exists, not who it belongs to
    if err := db.First(&order, "id = ?", orderID).Error; err != nil {
        return c.Status(404).JSON(fiber.Map{"error": "Order not found"})
    }
    return c.JSON(order)
})

The Secure Implementation

To kill BOLA in Go Fiber, you must implement mandatory ownership checks at the data access layer. The 'hacker' approach to exploitation is simply incrementing an ID in the URL to scrape data; your defense must be to ignore the user's perceived authority and force the database to validate the relationship. Always extract the 'Subject' (sub) from your verified JWT and inject it into every GORM/SQL query. If a user tries to access ID 500 but they only own ID 499, the query returns zero rows, and the attack is neutralized. Never trust a raw ID from a request parameter without a secondary 'owner_id' check.

app.Get("/api/orders/:id", func(c *fiber.Ctx) error {
    orderID := c.Params("id")
    // Retrieve the authenticated user's ID from the JWT/Session middleware locals
    userID := c.Locals("user_id").(string)
var order Order
// SECURE: The query is scoped to both the resource ID AND the owner's ID
result := db.Where("id = ? AND user_id = ?", orderID, userID).First(&order)

if result.Error != nil {
    // Return 403 or 404 to prevent resource enumeration
    return c.Status(403).JSON(fiber.Map{"error": "Unauthorized access to resource"})
}
return c.JSON(order)
})