Hiding an object in the interface does not make it inaccessible through an API. Verify ownership or access rights on every request.
Evaluation approach
Establish the user-object relationship on the server. Client-supplied account identifiers are not authority.
Application example
Order details should be returned only to authorized users. Test cross-account access with two permitted test accounts.
Limits and considerations
Valid attestation can coexist with broken object authorization. Client protection does not fix it.
Are unpredictable identifiers sufficient?
Hard-to-guess identifiers do not replace access control. Ownership checks must still work if an identifier is learned elsewhere. Include list and export endpoints.
Checks and decisions
- Authorize objects
- Test two accounts
- Use consistent errors
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.