#0106
An order management API exposes a bulk delete endpoint that accepts an array of order IDs. The handler deletes every ID in the list in a single operation.
The current implementation does not verify ownership for each order in the batch. An attacker can mix their own order IDs with IDs belonging to other users.
A single malicious request can silently delete other customers' orders by including foreign IDs alongside legitimate ones.
Bulk endpoints amplify IDOR risk. A single missing per-item ownership check can allow mass deletion or exfiltration of resources belonging to other users in one API call.
deleteOrders so it checks ownership for every order ID in the batch before deleting anything.'Forbidden' if any order in the list does not belong to the requesting user.'Not found' if any order ID does not exist.deleteOrders('alice', ['order-alice-1', 'order-bob-1'], db)// order-bob-1 belongs to bob// → throws Error('Forbidden')
deleteOrders('alice', ['order-alice-1', 'order-alice-2'], db)// → returns ['order-alice-1', 'order-alice-2']
'Forbidden' or 'Not found' before deleting anything — it must be atomic.