How to fix Business Logic Errors
in ServiceStack
Executive Summary
ServiceStack's DTO-centric design often leads developers into a false sense of security. If you're trusting the client-provided ID without verifying ownership against the authenticated session, you've opened an Insecure Direct Object Reference (IDOR) vector. Stop blindly trusting incoming DTOs; enforce session-bound constraints at the service implementation level. In business logic, 'Authenticated' does not mean 'Authorized' for every record.
The Vulnerable Pattern
[Authenticate] public class OrderService : Service { public object Post(UpdateOrder request) { // VULNERABLE: Only checks if user is logged in. // Any user can modify any OrderId by guessing the integer. var order = Db.SingleById(request.Id); if (order == null) throw HttpError.NotFound("Order not found"); order.Status = request.Status; Db.Update(order); return new UpdateOrderResponse { Success = true }; }
}
The Secure Implementation
The vulnerability is a classic IDOR. The insecure code retrieves a record based solely on a client-controlled 'Id'. An attacker can iterate through IDs to modify data belonging to other users. The secure implementation mitigates this by enforcing 'Object-Level Authorization'. By pulling the UserAuthId directly from the server-side session and including it in the database query predicate, we ensure that the database engine itself handles the ownership validation. If the ID exists but belongs to another user, the query returns null, preventing unauthorized state changes.
[Authenticate] public class OrderService : Service { public object Post(UpdateOrder request) { var session = GetSession(); var userId = session.UserAuthId;// SECURE: Predicate-based lookup ensures the record belongs to the caller. // Use UserAuthId from the session, never from the DTO. var order = Db.Single<Order>(x => x.Id == request.Id && x.OwnerId == userId); if (order == null) throw HttpError.NotFound("Order not found or access denied."); order.Status = request.Status; Db.Update(order); return new UpdateOrderResponse { Success = true }; }
}
Your ServiceStack API
might be exposed to Business Logic Errors
74% of ServiceStack apps fail this check. Hackers use automated scanners to find this specific flaw. Check your codebase before they do.
Free Tier • No Credit Card • Instant Report
Verified by Ghost Labs Security Team
This content is continuously validated by our automated security engine and reviewed by our research team. Ghost Labs analyzes over 500+ vulnerability patterns across 40+ frameworks to provide up-to-date remediation strategies.