Resource Ownership Verified

Fetching a resource by a client-supplied ID without verifying the requesting user owns it is Insecure Direct Object Reference — CWE-639 (Authorization Bypass Through User-Controlled Key). Any user who knows (or guesses) a resource ID can read or modify records they do not own. OWASP A01 (Broken Access Control) lists IDOR as a primary failure mode. UUIDs do not fix this: they are harder to guess but are not authorization controls. NIST 800-53 AC-3 requires that access enforcement be based on identity and authorization, not obscurity of identifiers. A missed ownership check on a single endpoint exposes the data of every user who has a record in that table.

Include ownership in the database query itself — making the check atomic with the fetch and impossible to accidentally omit. Return 404 (not 403) to avoid leaking whether the resource exists.

// Safe — ownership enforced at query level
const post = await db.post.findFirst({
  where: {
    id: params.id,
    authorId: session.user.id,   // Ownership is part of the lookup
  },
});

if (!post) return NextResponse.json({ error: 'Not found' }, { status: 404 });
// 404 (not 403) avoids confirming the resource exists to unauthorized callers

For shared resources accessed through organizational membership, verify the relationship through a membership table rather than relying on direct ownership.