The Anatomy of Authorization Failures

Why object-level checks keep slipping through review, and how to test for them systematically.

Why this keeps happening

Most findings in this class are not exotic. They appear when a boundary that exists in the design is not enforced in the code path that actually runs. Reviews miss them because the control lives one layer away from the request handler, and tests assert on behaviour rather than on authorization.

A defensible pattern

Push the check to the data access layer, make it impossible to query without an identity, and assert on it in tests. The snippet below sketches the shape of that control.

// authorization enforced where the data is read
async function getInvoice(userId: string, invoiceId: string) {
  const row = await db.invoice.findFirst({
    where: { id: invoiceId, ownerId: userId }, // ownership is part of the query
  });
  if (!row) throw new NotFoundError(); // do not leak existence
  return row;
}

Severity guidance

Takeaways

• Make the secure path the shortest path for developers.
• Test authorization as a first-class requirement, not an edge case.
• Log denials with enough context to detect probing without leaking data.