Fix BOLA (Broken Object Level Authorization) in Tornado

BOLA (Broken Object Level Authorization), formerly IDOR, remains the apex predator of API vulnerabilities. In Tornado, this manifests when a RequestHandler retrieves an object based on user-supplied input (like a UUID or integer ID) without verifying if the authenticated user has the rights to access that specific instance. If your code assumes that knowing an ID implies permission to view it, you're leaking data.

The Vulnerable Pattern

class InvoiceHandler(tornado.web.RequestHandler):
    async def get(self, invoice_id):
        # VULNERABLE: Direct reference to object without ownership check
        invoice = await self.db.get_invoice(invoice_id)
        if not invoice:
            raise tornado.web.HTTPError(404)
        self.write(invoice)

The Secure Implementation

To kill BOLA in Tornado, you must enforce authorization at the data access layer. Don't just fetch by ID; fetch by ID AND OwnerID. First, ensure the user is authenticated via `@tornado.web.authenticated`. Second, extract the identity from `self.current_user`. Third, modify your database queries to include the user's identity as a filter. If a user tries to access an ID they don't own, the query returns null, and you return a 404. This prevents attackers from 'walking' IDs to scrape your database.

class InvoiceHandler(tornado.web.RequestHandler):
    @tornado.web.authenticated
    async def get(self, invoice_id):
        current_user = self.get_current_user()
        # SECURE: Query includes the owner_id to enforce authorization at the DB level
        invoice = await self.db.get_invoice_by_user(invoice_id, current_user['id'])
    if not invoice:
        # Use 404 to prevent ID enumeration/probing
        raise tornado.web.HTTPError(404, "Invoice not found or access denied")
        
    self.write(invoice)</code></pre>