Fix BOLA (Broken Object Level Authorization) in Javalin

BOLA (Broken Object Level Authorization) is the apex predator of API vulnerabilities. In Javalin, it occurs when the application accepts a user-supplied ID (via pathParam or queryParam) and fetches the resource without verifying if the authenticated requester has the rights to access it. If you're building REST APIs and trusting the 'orderId' or 'userId' from the URL without a secondary ownership check, you're handing over your database to any script kiddie with Burp Suite.

The Vulnerable Pattern

app.get("/api/orders/{orderId}", ctx -> {
    // DANGER: Blindly trusting the path parameter
    String orderId = ctx.pathParam("orderId");
    Order order = repository.findOrderById(orderId);
// If order exists, it's returned regardless of who is asking
if (order != null) {
    ctx.json(order);
} else {
    ctx.status(404);
}
});

The Secure Implementation

To kill BOLA, you must enforce authorization at the object level. First, ensure your Javalin AccessManager or a prior filter populates the context with a trusted user identity. Second, never perform a lookup using only the primary key provided by the client. Always include the 'owner_id' in your SQL WHERE clause or repository method. This ensures that even if an attacker guesses a valid UUID/ID, the database query will return null because the ownership check fails server-side. For high-security environments, use non-enumerable IDs (UUIDv4) and implement a global 'Access Control Layer' that wraps your repository calls.

app.get("/api/orders/{orderId}", ctx -> {
    String orderId = ctx.pathParam("orderId");
    // 1. Extract the authenticated user from the context (e.g., from a JWT or Session)
    User currentUser = ctx.attribute("currentUser");
// 2. Query the resource using BOTH the resource ID and the Owner ID
Order order = repository.findByOrderIdAndOwnerId(orderId, currentUser.getId());

if (order == null) {
    // 3. Return 404 or 403. 404 is often preferred to prevent ID enumeration
    throw new NotFoundResponse("Order not found or access denied");
}

ctx.json(order);
});