Fix Insecure API Management in Camping

Camping's minimalism is a double-edged sword. While it stays out of your way, it lacks the 'magic' security defaults of Rails. Insecure API management in Camping typically manifests as Broken Object Level Authorization (BOLA) or IDOR. If you're fetching resources directly from the database using raw URL parameters without scoping to the authenticated user session, you're leaking data. This guide focuses on implementing scoped queries and session-based access control.

The Vulnerable Pattern

module CampingApp::Controllers
  class SecretNote < R '/note/(\d+)'
    def get(id)
      # VULNERABLE: Direct access via ID without ownership verification
      @note = Models::Note.find(id)
      render :note_view
    end
  end
end

The Secure Implementation

The vulnerability lies in trusting the client-provided ID parameter. In the insecure example, any authenticated (or even unauthenticated) user can access any note by guessing the integer ID. The fix implements Scoped Data Access: by chaining the query through the user's own relationship (user_id), we ensure the database only returns records belonging to the requester. Additionally, always use find_by to avoid unhandled exceptions and return a generic 404 to prevent resource enumeration.

module CampingApp::Controllers
  class SecretNote < R '/note/(\d+)'
    def get(id)
      # SECURE: Scope the lookup to the current authenticated user
      # Assuming @state.user_id is set during login
      @note = Models::Note.find_by(id: id, user_id: @state.user_id)
  if @note.nil?
    @status = 404
    return "Note not found or unauthorized"
  end
  
  render :note_view
end
end
end