A Valid JWT Does Not Mean Authorized Access
A security review of Salus brought me back to a question that remains after authentication: Can this user access this specific resource? Consider this scenario: User A creates patient X. User B signs in and receives a valid JWT. B calls GET /patients/X . If the application looks up the patient by patientId alone, B may receive a patient belonging to A. B is authenticated, but is not authorized to…
Having a valid JWT (JSON Web Token) does not guarantee authorized access to a specific resource. Authentication establishes the identity of the user, but authorization determines what actions that user is permitted to perform on that resource.
Take this example: User A creates a patient record for Patient X. User B later logs in and obtains a valid JWT. When User B attempts to retrieve Patient X using the GET /patients/X endpoint, the application may return the wrong patient if it only uses the patientId for lookup. This is known as Broken Object Level Authorization (BOLA). The application should verify the user's identity and ensure they have permission to access the requested object.
A valid JWT establishes who made the request, but the application must still apply the correct access rules using that identity to scope the resource lookup. Instead of a simple findById(patientId), the operation should be more precise, like findByIdAndOwner(patientId, currentUser.id). This ensures the access boundary is included in the lookup, applying to reads, updates, and deletes.
When a user attempts to access another user's patient record, the API should return a 403 Forbidden response, indicating that the user lacks permission to access that specific resource. In cases where the existence of the resource itself is sensitive, a 404 Not Found response might be more appropriate. The choice between these responses depends on the API's policy and should be applied consistently to avoid probing which IDs are accessible.
Security is not just about login, JWT, and middleware. It extends throughout each object operation: authentication, authorization, ownership verification, and finally, resource access. This sequence became a Salus security regression test. Initially, User A created Patient X, and User B, with a valid JWT, tried accessing it. The expected result was a 404 Not Found.
The team then introduced ownership checks, scoped operations by ownerId, and confirmed that cross-user access now correctly returned 404 in this scenario. The regression test now passes (GREEN), alongside JWT verification on patient routes. By treating security as verifiable behavior rather than just configuration, the system remains protected as it evolves.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
