Fix BOLA (Broken Object Level Authorization) in Nitro

BOLA (Broken Object Level Authorization) is the apex predator of API vulnerabilities. In Nitro-based backends, it happens when you fetch resources using user-supplied IDs from 'event.context.params' without verifying if the authenticated requester actually owns that resource. If your middleware only checks 'if (user)', you're already compromised. You must validate the relationship between the user and the object at the database layer.

The Vulnerable Pattern

export default defineEventHandler(async (event) => {
  const { id } = event.context.params;
  // VULNERABLE: Fetches record solely based on ID from URL
  const report = await db.reports.findUnique({ where: { id } });
  if (!report) throw createError({ statusCode: 404 });
  return report;
});

The Secure Implementation

The fix enforces 'Authorization at the Data Layer'. The vulnerable snippet assumes that because a user is logged in, they are allowed to see any ID they request. The secure version implements a composite filter: it matches the resource 'id' AND the 'ownerId' derived from the trusted session context. By using 'findFirst' with both constraints and returning a 404 on failure, we stop IDOR (Insecure Direct Object Reference) and prevent attackers from probing the existence of records belonging to other users.

export default defineEventHandler(async (event) => {
  const { id } = event.context.params;
  const user = event.context.user; // Populated by auth middleware
if (!user) {
throw createError({ statusCode: 401, message: ‘Unauthenticated’ });
}
// SECURE: Query scopes the search to the authenticated user’s ID
const report = await db.reports.findFirst({
where: {
id: id,
ownerId: user.id
}
});
if (!report) {
// Use 404 to prevent resource enumeration/discovery
throw createError({ statusCode: 404, message: ‘Resource not found’ });
}
return report;
});