Fix BOLA (Broken Object Level Authorization) in Fresh

Broken Object Level Authorization (BOLA) remains the most critical vulnerability in modern Deno/Fresh applications. It occurs when a handler retrieves a resource based on a user-controlled ID without verifying if the authenticated user has the rights to access that specific object. In Fresh, this typically happens inside the Handlers defined in routes.

The Vulnerable Pattern

// routes/api/orders/[id].ts
export const handler: Handlers = {
  async GET(_req, ctx) {
    const { id } = ctx.params;
    // VULNERABILITY: Directly fetching by ID from URL without checking ownerId
    const order = await kv.get(["orders", id]);
    if (!order.value) return new Response("Not Found", { status: 404 });
    return Response.json(order.value);
  }
};

The Secure Implementation

To fix BOLA in Fresh, you must implement a strict policy of Identity-Based Access Control. First, ensure your route is protected by middleware that populates `ctx.state` with the authenticated user's identity. Second, never perform a lookup based solely on the URL parameter. You must query the database and then perform a server-side comparison between the resource's 'owner' attribute and the 'user.id' from your session state. If they do not match, return a 403 Forbidden to prevent cross-account data leakage.

// routes/api/orders/[id].ts
export const handler: Handlers = {
  async GET(_req, ctx) {
    const { id } = ctx.params;
    const user = ctx.state.user; // Injected via auth middleware
if (!user) return new Response("Unauthorized", { status: 401 });

const order = await kv.get(["orders", id]);
if (!order.value) return new Response("Not Found", { status: 404 });

// DEFENSE: Explicitly verify that the resource owner matches the session user
if (order.value.userId !== user.id) {
  return new Response("Forbidden", { status: 403 });
}

return Response.json(order.value);
}
};

About this page

Framework notes in /guides are generated sketches kept for URL stability. They are not human pentest reports and they are not GuardAPI scan output. The product is a GET-only BOLA merge gate. Maintained by GuardAPI. Questions: support@guard-api.com