Changing the id in the URL
The invoice endpoint checks that the caller is signed in, then loads the invoice named in the URL and returns it. A customer changed the id in their address bar and read someone else's invoice.
Authentication answered "who are you". Nothing answered "is this yours". The two are different questions and only one of them was asked.
Add the check that's missing between identifying the caller and returning the record.
Components — tap one, then tap a slot on the diagram
!A customer changed the id in the URL and read another customer's invoice.
Outside every boundary: Signed-in user (valid token), Authentication (who are you), Invoices (everyone's; FAILED: reading others'), an empty slot for the before the record is loaded Connections: Signed-in user calls Authentication — token (step 1) Authentication calls before the record is loaded — identity (step 2) before the record is loaded calls Invoices — only if it's theirs (step 3)
Signed-in uservalid token
Authenticationwho are you
Invoiceseveryone'sreading others'