Fix Business Logic Errors in Hapi

Business logic errors in Hapi are silent killers that bypass traditional WAFs and signature-based scanners. These flaws occur when the application's state machine or authorization flow is manipulated. In the Hapi ecosystem, this usually manifests as Insecure Direct Object Reference (IDOR), mass assignment, or improper session binding where the server trusts client-provided identifiers over the authenticated session context.

The Vulnerable Pattern

server.route({
  method: 'POST',
  path: '/api/v1/account/update',
  handler: async (request, h) => {
    // VULNERABILITY: Trusting the userId provided in the payload.
    // An attacker can change any user's password/email by swapping the userId.
    const { userId, newEmail } = request.payload;
const user = await db.users.findOne({ id: userId });
if (user) {
  await db.users.update(userId, { email: newEmail });
  return { message: 'Success' };
}
return h.response({ error: 'Not found' }).code(404);
}
});

The Secure Implementation

The vulnerability is a classic IDOR (Insecure Direct Object Reference). The handler assumes that the 'userId' passed in the JSON payload belongs to the requester. An attacker can intercept the request and modify the 'userId' to target other accounts. The fix involves three critical steps: 1. Authentication binding: Use Hapi's 'request.auth.credentials' to identify the user based on their session/JWT, not payload parameters. 2. Strict Schema Validation: Use Joi to whitelist only the fields that are allowed to be changed, preventing 'Mass Assignment' attacks where an attacker might try to inject 'isAdmin: true' into the payload. 3. Least Privilege: Ensure the database query is scoped to the authenticated user's ID.

server.route({
  method: 'POST',
  path: '/api/v1/account/update',
  options: {
    auth: 'session', // Enforce authentication
    validate: {
      payload: Joi.object({
        // SECURE: Do not accept userId here; derive it from the session.
        newEmail: Joi.string().email().required()
      })
    }
  },
  handler: async (request, h) => {
    // FIX: Use the cryptographically signed identity from the auth strategy.
    const userId = request.auth.credentials.id;
    const { newEmail } = request.payload;
await db.users.update(userId, { email: newEmail });
return { message: 'Success' };
}
});