Auth & Security · 06 Ownership & IDOR

One guard for every owned resource

The middleware only needs one question answered: who owns this? Each route passes a function that answers it.

internal/authz/owner.go

// OwnerFunc returns the user id that owns the target.
type OwnerFunc func(r *http.Request) (string, error)

// PathOwner: the {param} in the URL *is* the owner id.
func PathOwner(param string) OwnerFunc {
    return func(r *http.Request) (string, error) {
        return r.PathValue(param), nil
    }
}

// PostOwner: load the post, return who owns it.
func PostOwner(r *http.Request) (string, error) {
    p, ok := posts[r.PathValue("id")]
    if !ok {
        return "", ErrNotFound
    }
    return p.OwnerID, nil
}

func OwnerOrAdmin(owner OwnerFunc,
    next http.Handler) http.Handler {
    fn := func(w http.ResponseWriter, r *http.Request) {
        c := auth.ClaimsFrom(r.Context())
        id, err := owner(r)
        if err != nil {
            http.Error(w, "not found", 404)
            return
        }
        if c.Subject != id && c.Role != "admin" {
            http.Error(w, "not found", 404)
            return
        }
        next.ServeHTTP(w, r)
    }
    return http.HandlerFunc(fn)
}

// wiring
mux.Handle("PATCH /users/{id}", guard(PathOwner("id"), patchUser))
mux.Handle("PATCH /posts/{id}", guard(PostOwner, editPost))

go run ./demos/06

── vulnerable: auth only, no ownership check
asha GET /users/7 → 200 {"id":"7","name":"Asha","email":"asha@example.com"}
asha GET /users/8 → 200 {"id":"8","name":"Ravi","email":"ravi@example.com"}
asha GET /users/9 → 200 {"id":"9","name":"Meera","email":"meera@example.com"}
── guarded: OwnerOrAdmin
asha  GET   /users/7 → 200 {"id":"7","name":"Asha","email":"asha@example.com"}
asha  GET   /users/8 → 404 not found
asha  PATCH /users/7 → 200 {"id":"7","name":"Asha K","email":"asha@example.com"}
asha  PATCH /users/8 → 404 not found
admin PATCH /users/8 → 200 {"id":"8","name":"Ravi S","email":"ravi@example.com"}
asha  PATCH /posts/3 → 404 not found
admin PATCH /posts/3 → 200 post updated

→Compare against c.Subject from the verified token — never an id from the body or a header.

→404, not 403, for someone else's resource — don't confirm that user 8 exists.

→Nested resources (a post, an order) load the owner from the database — the URL alone can't tell you.

→For list endpoints, filter in the query: WHERE owner_id = $1.

HANDS-ON · TOPIC 2

Edit own profile — or any, as Admin

PATCH /users/{id} wrapped in RequireAuth(OwnerOrAdmin(PathOwner("id"), …)).
A user can change only their own name; an admin can change anyone's.
Reuse the same guard for PATCH /posts/{id} with a PostOwner loader.
Tests: own → 200, other → 404, admin → 200, no token → 401.

Ownership & IDOR

Change one number in the URL

One guard for every owned resource

Edit own profile — or any, as Admin

Session 06 in four lines