Authorization and owner-scope rule | DevPrompt Lab

A practical rule for preventing insecure direct object references while keeping existing authentication flows intact.

Reusable content

For every private or user-owned record, enforce ownership in the database query or domain service; do not rely on a hidden UI control. Use the established credential and role checks. Keep session-only actions separate from API-key actions where required. For admin mutations, require the existing verified admin session and any configured second factor. Return the application's safe not-found behavior for records outside the caller's scope. Add tests for owner access, cross-owner denial, and anonymous access. Do not redesign authentication without a confirmed vulnerability.

Resource type: {{RESOURCE_TYPE}}

Admin policy: {{ADMIN_POLICY}}

How to use it

Adapt only the existing policy details; this rule is not a substitute for the codebase's security documentation.

Example

SELECT ... FROM projects WHERE id = :id AND user_id = :current_user_id