Access and configuration
Enforce object authorization
Use trusted identity and server-owned relationships for every read and write instead of treating object IDs or hidden controls as permission.
8 minute lesson
A signed-in user is not authorized for every record. Changing /notes/123 to /notes/124 must not cross an ownership boundary.
Filter queries by both object and trusted owner or tenant. Apply the rule to reads, mutations, exports, search, and bulk operations. Test with two ordinary users and an administrator.
Alice requests /notes/42, then changes the ID to Bob’s note. The route sees a valid session and returns the record because the query checks only id.
Hiding the note ID or using a UUID makes guessing harder but does not create permission. The query still needs the trusted owner or tenant relationship.
Use two valid accounts to test read, update, delete, export, and search for the same note. Save each response and verify Bob’s stored data never appears or changes when Alice acts.
Lesson completed