Fix Business Logic Errors in Remix

Remix's server-side focus means business logic is concentrated in loaders and actions. The most critical failures occur when developers treat client-provided identifiers (params or formData) as trusted sources of truth. Without rigorous session-to-resource mapping, your application is vulnerable to IDOR and unauthorized state transitions. In Remix, the 'Action' is your primary attack surface; if you don't verify ownership server-side, you're handing the keys to the kingdom to anyone with Burp Suite.

The Vulnerable Pattern

export const action = async ({ request }: ActionFunctionArgs) => {
  const formData = await request.formData();
  const invoiceId = formData.get('invoiceId');
  const status = formData.get('status');
// VULNERABILITY: Blindly trusting invoiceId from the client
// An attacker can change invoiceId to any UUID in the database
await db.invoice.update({
where: { id: invoiceId },
data: { status: status }
});
return json({ success: true });
};

The Secure Implementation

The vulnerable snippet fails because it performs a 'naked update'—it uses a client-controlled ID without verifying authorization. An attacker simply needs to iterate the 'invoiceId' to manipulate data across the entire platform. The secure implementation enforces three pillars of AppSec: 1. Identity Verification (retrieving the userId from a secure, server-side session), 2. Input Validation (using Zod to ensure data types are correct), and 3. Authorization Scoping (modifying the database query to include the 'ownerId' in the WHERE clause). If the query affects zero rows, we treat it as a security boundary violation and return a 404/403.

export const action = async ({ request }: ActionFunctionArgs) => {
  const userId = await requireUserId(request); // 1. Authenticate session
  const formData = await request.formData();
const submission = schema.safeParse(Object.fromEntries(formData));
if (!submission.success) return json({ errors: submission.error }, { status: 400 });
const { invoiceId, status } = submission.data;
// 2. Scoped Query: Ensure the record belongs to the authenticated user
const result = await db.invoice.updateMany({
where: {
id: invoiceId,
ownerId: userId // Logic: Only update if user owns the resource
},
data: { status }
});
if (result.count === 0) {
throw new Response(‘Not Found or Unauthorized’, { status: 404 });
}
return json({ success: true });
};