Fix BOLA (Broken Object Level Authorization) in ElysiaJS

BOLA (Broken Object Level Authorization) remains the #1 vulnerability on the OWASP API Security Top 10. In ElysiaJS, it occurs when a developer trusts the 'id' parameter from the request path without verifying if the authenticated user actually owns the resource. If your logic assumes that 'authenticated' equals 'authorized to see everything', you are leaking data. To kill BOLA, you must scope every database query to the requester's identity.

The Vulnerable Pattern

import { Elysia } from 'elysia';
new Elysia()
.get(‘/invoice/:id’, async ({ params: { id }, set }) => {
// VULNERABLE: Any logged-in user can guess an ID and steal invoices.
// There is no check to see if the invoice belongs to the requester.
const invoice = await db.invoice.findUnique({ where: { id: Number(id) } });
if (!invoice) return (set.status = 404);
return invoice;
});

The Secure Implementation

The fix involves 'Resource-based Access Control'. Instead of using .findUnique() with just an ID, use .findFirst() and include the 'ownerId' (retrieved from your verified JWT/Session) in the WHERE clause. By using Elysia's .derive() method, you inject the user's identity into the context, ensuring that the authorization logic is baked into the data retrieval layer. If a hacker tries to access 'invoice/99', the query will return nothing because 'invoice 99' does not match their 'ownerId'.

import { Elysia, t } from 'elysia';
new Elysia()
.derive(({ headers }) => {
const user = auth.verify(headers.authorization);
return { user };
})
.get(‘/invoice/:id’, async ({ params: { id }, user, error }) => {
// SECURE: We filter the query by both the resource ID AND the user ID.
// If the user doesn’t own the invoice, the DB returns null, preventing leakage.
const invoice = await db.invoice.findFirst({
where: {
id: Number(id),
ownerId: user.id
}
});
if (!invoice) return error(404, 'Invoice not found or unauthorized');
return invoice;
}, {
params: t.Object({ id: t.String() })
});