Broken Access Control in Fastapi with Mongodb

Broken Access Control occurs when API endpoints fail to enforce proper authorization checks, allowing authenticated users to access or modify resources that belong to other users. In a Fastapi application using Mongodb, this commonly arises when route-level permissions rely only on user authentication (e.g., a valid JWT) and do not verify that the requesting user owns or is permitted to access the targeted document.

Consider a Fastapi endpoint designed to retrieve a user profile by ID:

from fastapi import FastAPI, Depends, HTTPException
from pymongo import MongoClient
from bson import ObjectId

app = FastAPI()
client = MongoClient("mongodb://localhost:27017")
db = client["mydb"]
users_collection = db["users"]

# Vulnerable: no ownership check
@app.get("/users/{user_id}")
async def read_user(user_id: str, token_user_id: str = Depends(get_current_user_id)):
    user = users_collection.find_one({"_id": ObjectId(user_id)})
    if user is None:
        raise HTTPException(status_code=404, detail="User not found")
    return user

If token_user_id is not compared against user_id, any authenticated user can enumerate or access any user document by guessing or iterating IDs. This is a classic BOLA/IDOR pattern, one of the 12 security checks run by middleBrick. The risk is compounded when the endpoint exposes sensitive fields (e.g., roles, reset tokens) or when ObjectId values are predictable, enabling horizontal privilege escalation.

Broken Access Control in this stack is not limited to read operations. Write endpoints that accept user-supplied IDs without verifying ownership can lead to unauthorized updates or deletes. For example, an endpoint that modifies a user’s email should ensure the target document belongs to the caller, otherwise attackers can change other users’ emails or escalate privileges by modifying admin flags stored in the same collection.

Because Fastapi does not enforce authorization at the framework level, developers must explicitly code ownership checks. Mongodb’s flexible schema can unintentionally expose relationships (e.g., embedding role flags) that, if returned without filtering, become an information leak. middleBrick’s checks include Authentication, BOLA/IDOR, and Property Authorization to surface these classes of flaws and provide prioritized findings with remediation guidance.

To fix Broken Access Control when using Fastapi and Mongodb, enforce strict ownership checks and scope queries to the requesting user. Avoid trusting client-supplied IDs alone; derive the user identity from the authenticated context and use it to constrain database operations.

Here is a secure pattern for reading a user profile:

from fastapi import FastAPI, Depends, HTTPException
from pymongo import MongoClient
from bson import ObjectId

app = FastAPI()
client = MongoClient("mongodb://localhost:27017")
db = client["mydb"]
users_collection = db["users"]

async def get_current_user_id(token: str = Depends(oauth2_scheme)):
    # validate token and return the user’s ObjectId string
    payload = decode_token(token)
    return payload["sub"]

@app.get("/users/me")
async def read_own_user(token_user_id: str = Depends(get_current_user_id)):
    user = users_collection.find_one({"_id": ObjectId(token_user_id)})
    if user is None:
        raise HTTPException(status_code=404, detail="User not found")
    return user

The key change is removing the user-supplied user_id path parameter and deriving the ID from the token. This ensures users can only access their own document. For endpoints that legitimately require admin access, implement an explicit role check:

async def require_admin(token_user_id: str):
    user = users_collection.find_one({"_id": ObjectId(token_user_id)})
    if user.get("role") != "admin":
        raise HTTPException(status_code=403, detail="Admin required")
    return user

@app.delete("/users/{user_id}")
async def delete_user(user_id: str, admin: dict = Depends(require_admin)):
    result = users_collection.delete_one({"_id": ObjectId(user_id)})
    if result.deleted_count == 0:
        raise HTTPException(status_code=404, detail="User not found")
    return {"deleted": True}

When designing queries, always scope by the user identifier and avoid returning sensitive fields unless necessary. For example, exclude passwords and tokens from query results:

user = users_collection.find_one(
    {"_id": ObjectId(token_user_id)},
    {"password": 0, "reset_token": 0}  # explicitly exclude sensitive fields
)

These patterns align with the OWASP API Top 10 and map to compliance frameworks such as SOC2 and GDPR. middleBrick’s findings will highlight missing ownership checks and overly broad permissions, with remediation guidance tailored to Fastapi and Mongodb. In environments requiring continuous monitoring, the Pro plan provides scheduled scans and GitHub Action integration to catch regressions before they reach production.