Broken Object-Level Authorization (BOLA) in Next.js apps

What it is

BOLA (sometimes called IDOR — Insecure Direct Object Reference) happens when an API exposes an object by its identifier and does not verify that the requesting user is authorized to see that specific object. Any authenticated user can usually change a number in the URL and read someone else's data.

Vulnerable example

// app/api/orders/[id]/route.ts — vulnerable: fetches without authz check
import { createClient } from "@/lib/supabase/server";

export async function GET(req: Request, { params }: { params: { id: string } }) {
  const supabase = await createClient();
  const { data, error } = await supabase
    .from("orders")
    .select("*")
    .eq("id", params.id)
    .single();

  if (error) return new Response("not found", { status: 404 });
  return Response.json(data);
}

Fixed example

// Fixed: RLS on the table + explicit user scoping in the query
import { createClient } from "@/lib/supabase/server";

export async function GET(req: Request, { params }: { params: { id: string } }) {
  const supabase = await createClient();
  const { data: { user } } = await supabase.auth.getUser();
  if (!user) return new Response("unauthorized", { status: 401 });

  const { data, error } = await supabase
    .from("orders")
    .select("*")
    .eq("id", params.id)
    .eq("user_id", user.id)
    .single();

  if (error) return new Response("not found", { status: 404 });
  return Response.json(data);
}

How Securie catches it

// Fixed: RLS on the table + explicit user scoping in the query
import { createClient } from "@/lib/supabase/server";

export async function GET(req: Request, { params }: { params: { id: string } }) {
  const supabase = await createClient();
  const { data: { user } } = await supabase.auth.getUser();
  if (!user) return new Response("unauthorized", { status: 401 });

  const { data, error } = await supabase
    .from("orders")
    .select("*")
    .eq("id", params.id)
    .eq("user_id", user.id)
    .single();

  if (error) return new Response("not found", { status: 404 });
  return Response.json(data);
}

Checklist

• Every API route that accepts an ID verifies the requesting user owns that object
• Authorization checks happen in both the API layer and the database (defense in depth)
• Integration tests cover cross-user access attempts, not just happy-path reads
• Pagination endpoints do not leak IDs the user cannot access
• Object IDs are UUIDs (not incrementing integers) to reduce enumeration risk
• Failed authorization returns a 404 or 403 consistently — never 200 with an empty body

FAQ

Related guides