Fix Logic Flow Bypass in Grape

Logic flow bypasses in Grape APIs occur when the application assumes a specific sequence of requests or trusts client-provided state indicators to skip critical business rules. Attackers manipulate request parameters or headers to jump directly to sensitive actions, such as finalizing an order without payment or escalating privileges by bypassing intermediate validation steps.

The Vulnerable Pattern

resource :orders do
  desc 'Complete a purchase'
  params do
    requires :id, type: Integer
    requires :is_paid, type: Boolean # VULNERABILITY: Trusting client-side state
  end
  post ':id/finalize' do
    order = Order.find(params[:id])
    if params[:is_paid]
      order.update!(status: 'completed')
      { status: 'success' }
    else
      error!('Payment required', 402)
    end
  end
end

The Secure Implementation

The vulnerable snippet relies on the 'is_paid' parameter provided by the user. An attacker can simply intercept the request and change this value to 'true' to bypass payment. The secure version removes the client-side flag and implements a server-side check against a trusted source (database or external payment provider). To prevent logic bypasses, always implement a strict state machine where transitions are only possible if internal conditions are met, and never trust the client to report its own progress in a multi-step workflow.

resource :orders do
  desc 'Complete a purchase'
  params do
    requires :id, type: Integer
  end
  post ':id/finalize' do
    order = Order.find(params[:id])
# SECURE: Verify state against the database/source of truth, not parameters
payment_status = PaymentGateway.check_status(order.payment_intent_id)

if payment_status == 'succeeded'
  order.update!(status: 'completed')
  { status: 'success' }
else
  error!('Forbidden: Logic Flow Violation', 403)
end
end
end