Server-Side Ownership Checks
Deny by default; load object; compare owner/tenant to caller.
Visual · api_server_checks
Server policy is the fix. Original Cyberlium.
The fix is a check, not a hope.
Correct pattern: authenticate, load object, compare ownership/tenant/role, then act. Centralize helpers so every route does not reinvent policy.
1. Deny by default
If ownership is unclear, refuse. Do not return partial secrets.
Use 404 vs 403 carefully — both can be correct; be consistent.
Command guide
Try these commands — Deny by default
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
Server-side authz — https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html OWASP API Security — https://owasp.org/API-Security/
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
curl -sS -o /dev/null -w "own object %{http_code}
" -H "Authorization: Bearer userB" http://127.0.0.1:8815/orders/1002
curl -sS -o /dev/null -w "wrong owner %{http_code}
" -H "Authorization: Bearer userA" http://127.0.0.1:8815/orders/1002
curl -sS -H "Authorization: Bearer userA" http://127.0.0.1:8815/orders/1001 | head -c 300Primary tools to practice this lesson: curl. Reference sites: Server-side authz (https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html); OWASP API Security (https://owasp.org/API-Security/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Tests you should write
Automated tests: userA cannot read userB resources.
Include vertical cases (user cannot hit admin objects).
3. Gateways help, do not replace
API gateways authenticate and rate-limit; object checks still live in services.
Module 10 returns to gateways.
4. What you ship: ownership check pattern
Authenticate → load → compare → act. Tests for peer deny.
5. What you record before the next lesson
Pattern + test idea written.
6. Wrong vs right: stranger APIs vs literacy on systems you own
Worked failure — same API word, opposite target. Right never needs a live shop or classmate token.
- Wrong: Rely on “IDs are random” as the only control.
- Right: Write the pattern. Next: BOLA lab.
Mission: write ownership pattern
1) Write deny-by-default. 2) Write compare owner to caller. 3) Write one automated test idea.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “404 vs 403 for missing objects?”
APPLY: Fix for BOLA:
APPLY: True or False: Gateway auth replaces object checks.
APPLY: Deny by default means: