medium10 pts · first answer countssecurityauthorizationowasp

Any user can read any invoice

GET /invoices/:id requires login, but a tester shows that changing the id returns other customers' invoices. What is the correct fix?

A.On every request, check that the invoice belongs to the caller or their organisation, and return 404 or 403 if notB.Switch to random UUIDs so ids cannot be guessed or enumerated, and keep the existing login check as the only gateC.Add rate limiting so the tester cannot try many idsD.Change the endpoint to POST so ids are not visible in the URL

← Risk of "import image from URL"Saving req.body directly →