Web Security / Thinking like a defender

Lesson 4 of 27

Broken access control

If changing /invoice/101 to /invoice/102 shows someone else's invoice, access control is broken. The server must check ownership for every object it returns.

@app.route("/invoice/<int:id>")
@login_required
def invoice(id):
    inv = get_invoice(id)
    if inv is None or inv.owner_id != current_user.id:
        abort(404)
    return render(inv)