Authorization enforces object-level access control

Broken Object Level Authorization (OWASP API Security Top 10 2023 API1) is the single most exploited API vulnerability class. Authentication confirms who you are; object-level authorization confirms what you can touch. Without it, any authenticated user can substitute another user's ID in a URL and retrieve or modify that user's data — orders, messages, payment methods, medical records. CWE-639 (Authorization Bypass Through User-Controlled Key) describes exactly this pattern: the key is user-supplied, the backend trusts it. Real-world incidents like the Optus breach involved straightforward IDOR on predictable object IDs.

After authenticating the user, always fetch the resource and compare its owner field against the authenticated user's ID before returning or modifying it. Never trust a resource ID from the URL without verifying ownership server-side.

// src/app/api/orders/[id]/route.ts
export async function GET(req: Request, { params }: { params: { id: string } }) {
  const user = await getAuthUser(req)
  if (!user) return new Response('Unauthorized', { status: 401 })

  const order = await db.order.findUnique({ where: { id: params.id } })
  if (!order) return new Response('Not Found', { status: 404 })

  // Ownership check — do this before returning any data
  if (order.userId !== user.id) return new Response('Forbidden', { status: 403 })

  return Response.json(order)
}

Apply the same pattern to PATCH, PUT, and DELETE handlers.