Broken Access Control Prevention in Spring Boot – OWASP A01

Direct Answer

Broken Access Control means the server lets a principal read data or perform an action outside its permissions. Examples include changing /orders/101 to /orders/102, calling an admin action as a normal user, or trusting a tenant ID from the request. In Spring Boot, deny by default, protect requests and methods, scope database access to the current principal or tenant, and test horizontal and vertical privilege changes. Authentication alone is not authorization.

Code Example

@RestController
@RequestMapping("/api/orders")
class OrderController {
    private final OrderService orders;

    @GetMapping("/{id}")
    @PreAuthorize("isAuthenticated()")
    OrderDto get(@PathVariable long id, Authentication auth) {
        return orders.findForUser(id, auth.getName());
    }

    @DeleteMapping("/{id}")
    @PreAuthorize("hasRole('ADMIN')")
    void delete(@PathVariable long id) {
        orders.delete(id);
    }
}

@Service
class OrderService {
    OrderDto findForUser(long id, String username) {
        return repository.findByIdAndUsername(id, username)
            .map(OrderDto::from)
            .orElseThrow(ResourceNotFoundException::new);
    }
}

The user-controlled ID is not trusted by itself; the query includes the current principal. Administrative policy remains a separate explicit check.

Common Mistakes & Pitfalls

• URL-Level Security Only: Configuring .requestMatchers("/api/**").authenticated() in SecurityFilterChain and believing all endpoints are now secure—this only verifies someone is logged in, not whether they can access specific resources.
• Trusting Client Input: Taking an order ID from the request and immediately querying the database without ownership verification, allowing attackers to iterate through IDs and access all orders.
• Hidden Through Obscurity: Removing links from the UI for unauthorized actions but leaving the actual API endpoints unprotected—attackers don't need your UI, they call APIs directly with Postman.
• Checking Authorization in Frontend Only: Disabling delete buttons for non-admins in React but having /api/orders/123/delete accept requests from anyone authenticated—UI controls are not security controls.