How do you make sure every read and write checks that this user is allowed to see this record?
- Module
- 02/05
- To read
- ~9 min
An invoices API checked that the user was signed in, then fetched the invoice by the ID in the URL. What do you think a curious customer found?
In the module you make your guess first, then read what happened and why.
Check the Record, Not Just the Login
Enforce It on the Server, at Every Entry Point
Deny by Default, in the Database Too
Return and Accept Only Allowed Fields
Access rules: who can see what
A spec for your own app, as a text file you download. The module also gives you the prompt for Claude Code, Codex or Antigravity, a checklist to check what it built, and recommended skills.
- Authentication and authorization
- API gateways