Fix Business Logic Errors in Chi

Business logic errors in Chi-based Go services are the silent killers of API security. While Chi handles routing efficiently, it doesn't enforce authorization at the resource level. Hackers look for IDORs and state machine bypasses where the application assumes that because a user is authenticated, they are authorized to access any UUID or ID passed in the URL parameters. If you're not verifying ownership after the router parses the path, you're leaking data.

The Vulnerable Pattern

func GetInvoice(w http.ResponseWriter, r *http.Request) {
	// VULNERABILITY: IDOR. Any authenticated user can access any invoice ID.
	invoiceID := chi.URLParam(r, "invoiceID")
	invoice, err := db.FindInvoice(invoiceID)
	if err != nil {
		http.Error(w, "Not found", 404)
		return
	}
	json.NewEncoder(w).Encode(invoice)
}

The Secure Implementation

The vulnerability is a classic Insecure Direct Object Reference (IDOR). The router extracts 'invoiceID' from the URL, but the handler fails to verify if the 'userID' stored in the session context actually owns that invoice. To fix this, you must implement a logic gate that compares the resource's owner attribute against the requester's identity. In a Chi ecosystem, this is best handled either within the handler or via a resource-specific middleware that pre-fetches the object and checks permissions before the final handler is reached.

func GetInvoice(w http.ResponseWriter, r *http.Request) {
	invoiceID := chi.URLParam(r, "invoiceID")
	// Retrieve user identity from context (populated by Auth middleware)
	userID := r.Context().Value("userID").(string)
invoice, err := db.FindInvoice(invoiceID)
if err != nil {
	http.Error(w, "Not found", 404)
	return
}

// SECURE: Explicit ownership validation
if invoice.OwnerID != userID {
	http.Error(w, "Forbidden: Resource ownership mismatch", 403)
	return
}

json.NewEncoder(w).Encode(invoice)
}