Fix BOLA (Broken Object Level Authorization) in Gin

BOLA (Broken Object Level Authorization) remains the #1 threat in the OWASP API Top 10. In Gin-based microservices, it occurs when an endpoint trusts a user-supplied ID (e.g., /api/orders/:id) without verifying if the authenticated requester actually owns that resource. To kill BOLA, you must enforce authorization at the data layer, not just the routing layer.

The Vulnerable Pattern

func GetOrder(c *gin.Context) {
	orderID := c.Param("id")
	var order Order
	// VULNERABILITY: Fetching by ID only. Any authenticated user can access any order.
	if err := db.First(&order, orderID).Error; err != nil {
		c.JSON(404, gin.H{"error": "Not found"})
		return
	}
	c.JSON(200, order)
}

The Secure Implementation

Stop trusting the client. The fix involves three steps: 1. Extract the requester's identity from a secure session or JWT (set in a Gin middleware). 2. Modify your GORM/SQL queries to include a 'WHERE user_id = ?' clause. 3. Return a generic 404 Not Found if the record isn't owned by the user; this prevents 'ID Mining' where attackers probe for valid resource IDs by checking for 403 vs 404 responses.

func GetOrder(c *gin.Context) {
	// Retrieve authenticated UserID from middleware context
	userID, _ := c.Get("userID")
	orderID := c.Param("id")
	var order Order
// SECURE: Scope the query by both resource ID AND owner ID
result := db.Where("id = ? AND user_id = ?", orderID, userID).First(&order)

if result.Error != nil {
	// Return 404 regardless of whether it exists or is unauthorized to prevent ID enumeration
	c.JSON(404, gin.H{"error": "Order not found"})
	return
}
c.JSON(200, order)
}

Prove it on the next pull request

This page is a generated code sketch, not a GuardAPI scan. After you scope the query by tenant, fail the GitHub job when tenant B can still GET tenant A's object. GET-only. Tokens stay in GitHub Secrets.

- uses: GuardAPI/ghost-api@v6
  with:
    api-key: ${{ secrets.GUARD_API_KEY }}
    openapi-path: ./openapi.json
    base-url: ${{ secrets.STAGING_API_URL }}
    token-a: ${{ secrets.TOKEN_USER_A }}
    token-b: ${{ secrets.TOKEN_USER_B }}

Install docs · 14-day trial · How the fail rule works