#0101
An e-commerce API exposes a GET /orders/:id endpoint. Authenticated users supply their user ID and the order ID they want to retrieve.
The handler fetches the order by ID and returns it — but never checks whether the requesting user actually owns that order.
Any authenticated user can enumerate order IDs and read every other customer's purchase history, shipping address, and payment details. This is Broken Object Level Authorization — the #1 API vulnerability in the OWASP API Security Top 10.
BOLA is the most widespread API vulnerability class. Because IDs are often sequential integers, a single missing ownership check exposes every record in the table to any authenticated user.
getOrder so it rejects requests where the order's owner does not match the requesting user.'Forbidden' for unauthorized access attempts.getOrder('alice', 'order-bob-1', db)// order-bob-1 belongs to bob// → throws Error('Forbidden')
getOrder('bob', 'order-bob-1', db)// → returns { id: 'order-bob-1', ownerId: 'bob', ... }
'Forbidden' (not 'Unauthorized' or similar).db parameter is a plain in-memory collection.