Agent Wranglers

API security Required

Authorise every object

Check on every request that the caller may access the exact object, not just the endpoint.

By Erik Bergstedt, Agent Wranglers. Updated .

How to do it

Load the object through a query scoped to the caller, so another tenant's ID simply isn't found. The security playbook's object access rule has the attack.

How to check

Request another customer's order with your own token. The answer is 404.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers api design playbook: https://agentwranglers.se/playbook/api-design/api-security/object-authorisation.