Fix Insecure API Management in LoopBack

import {get, param} from '@loopback/rest';
import {repository} from '@loopback/repository';
import {UserRepository} from '../repositories';
export class UserController {
constructor(@repository(UserRepository) public userRepository: UserRepository) {}
// VULNERABLE: No authentication or authorization decorators.
// Anyone can query any user ID and retrieve sensitive profile data.
@get(‘/users/{id}’)
async findById(@param.path.string(‘id’) id: string): Promise {
return this.userRepository.findById(id);
}
}

import {authenticate} from '@loopback/authentication';
import {authorize} from '@loopback/authorization';
import {inject} from '@loopback/core';
import {SecurityBindings, UserProfile} from '@loopback/security';
import {HttpErrors, get, param} from '@loopback/rest';
export class UserController {
constructor(@repository(UserRepository) public userRepository: UserRepository) {}
@authenticate(‘jwt’)
@authorize({allowedRoles: [‘admin’, ‘owner’]})
@get(‘/users/{id}’)
async findById(
@param.path.string(‘id’) id: string,
@inject(SecurityBindings.USER) currentUser: UserProfile
): Promise {
// SECURE: Identity verification + Ownership check (BOLA mitigation)
if (currentUser.id !== id && !currentUser.roles?.includes(‘admin’)) {
throw new HttpErrors.Forbidden(‘Unauthorized access to resource’);
}
return this.userRepository.findById(id);
}
}