Broken Access Control in Strapi with Basic Auth

Broken Access Control occurs when authorization checks are missing or incorrectly applied, allowing a subject to access resources or perform actions they should not. In Strapi, this can manifest when an API endpoint relies on Basic Authentication for identity but does not enforce role- or permission-based checks on the authenticated subject. Basic Auth in Strapi is typically implemented via a custom header or middleware that maps a base64-encoded username:password pair to a user in the system. If Strapi then serves content without verifying that the authenticated user is allowed to view or modify the specific resource instance, BOLA/IDOR arises.

Consider an endpoint like GET /api/articles/:id. With Basic Auth, Strapi might authenticate a user but then return the article record even when the authenticated user does not own it or does not have the required scope. This is a BOLA (Broken Level Authorization) pattern, which is one of the 12 security checks middleBrick runs in parallel. An attacker who enumerates numeric IDs can iterate through records and, if Strapi lacks per-instance authorization, read or manipulate data across privilege boundaries. The risk is compounded when sensitive fields such as internal references or computed values are exposed without Property Authorization checks.

Input Validation weaknesses can further enable access control bypass. If Strapi does not strictly validate parameters used in database queries, an attacker may supply crafted values that change the query context and return records the authenticated user should not see. middleBrick’s checks for Input Validation and Property Authorization highlight whether data exposure occurs when Basic Auth is used without tight constraints. For example, an unchecked string identifier could lead to Insecure Direct Object References (IDOR), where an authenticated but low-privilege user accesses administrative endpoints or other users’ data.

Because Basic Auth transmits credentials in a base64-encoded string (not encrypted) unless protected by TLS, Transport Layer Security (Encryption) is a necessary complement but not sufficient on its own. Even when credentials are protected in transit, missing rate limiting can enable brute-force attempts against valid usernames, and missing proper Inventory Management controls may allow deprecated or overly permissive roles to remain active. middleBrick’s scan would flag findings across these categories—Authentication, BOLA/IDOR, Property Authorization, Input Validation, and Encryption—when authorization is not strictly enforced alongside Basic Auth in Strapi.

middleBrick tests these scenarios without authentication by probing the unauthenticated attack surface and, when credentials are supplied, validating that each subject can only access explicitly permitted resources. The scanner correlates OpenAPI/Swagger definitions (including full $ref resolution) with runtime behavior to identify mismatches between declared permissions and actual enforcement. This helps surface subtle authorization flaws that are not apparent in code review alone.

To mitigate Broken Access Control when using Basic Auth in Strapi, combine transport security, strict input validation, per-request authorization, and well-scoped policies. Below are concrete steps with code examples.

1. Enforce HTTPS and validate credentials on each request. Use Strapi middleware to verify the Authorization header and ensure the user is active and has the correct scopes before proceeding.

// src/middlewares/basic-auth.js
module.exports = (config, { strapi }) => {
  return async (ctx, next) => {
    const auth = ctx.request.header.authorization;
    if (!auth || !auth.startsWith('Basic ')) {
      ctx.status = 401;
      ctx.body = { error: 'Unauthorized' };
      return;
    }
    const base64 = auth.split(' ')[1];
    const decoded = Buffer.from(base64, 'base64').toString('utf-8');
    const [username, password] = decoded.split(':');
    if (!username || !password) {
      ctx.status = 401;
      ctx.body = { error: 'Invalid credentials format' };
      return;
    }
    const user = await strapi.db.query('plugin::users-permissions.user').findOne({
      where: { username, provider: 'local' },
    });
    if (!user || user.password !== hashPassword(password)) {
      ctx.status = 403;
      ctx.body = { error: 'Forbidden' };
      return;
    }
    ctx.state.user = user;
    await next();
  };
};

2. Apply per-instance authorization in controllers. After authentication, check that the authenticated user is allowed to access the specific resource instance by comparing identifiers such as user ID or tenant ID.

// src/api/article/controllers/article.js
module.exports = {
  async findOne(ctx) {
    const { id } = ctx.params;
    const user = ctx.state.user;
    const article = await strapi.db.query('api::article.article').findOne({
      where: { id, author: user.id },
    });
    if (!article) {
      ctx.status = 404;
      return;
    }
    return article;
  },
};

3. Tighten Input Validation to prevent IDOR via crafted parameters. Validate that identifiers are integers within an expected range and that query filters do not allow unintended traversal.

// src/api/article/controllers/article.js with validation
const { number } = require('yup');
module.exports = {
  async findOne(ctx) {
    const schema = number().positive().integer();
    let id;
    try {
      id = schema.validateSync(ctx.params.id);
    } catch (err) {
      ctx.status = 400;
      ctx.body = { error: 'Invalid ID' };
      return;
    }
    const user = ctx.state.user;
    const article = await strapi.db.query('api::article.article').findOne({
      where: { id, author: user.id },
    });
    if (!article) {
      ctx.status = 404;
      return;
    }
    return article;
  }
};

4. Use Policies to enforce role- and permission-based checks consistently. Define granular policies that map user roles to allowed actions and apply them to routes in the admin and API configurations.

// src/policies/has-scope.js
module.exports = (config, { strapi }) => {
  return async (ctx, next) => {
    const user = ctx.state.user;
    const required = config.scope || 'read';
    const permissions = user.permissions || [];
    if (!permissions.includes(required)) {
      ctx.status = 403;
      ctx.body = { error: 'Insufficient scope' };
      return;
    }
    await next();
  };
};

5. Apply rate limiting and monitor unusual patterns. Even with proper authorization, high request rates from a single authenticated identity may indicate abuse. Use Strapi’s built-in or proxy-level controls to limit requests per user.

middleBrick’s scans can validate these controls by checking Authentication, BOLA/IDOR, Property Authorization, Input Validation, and Rate Limiting in parallel. The results map findings to frameworks such as OWASP API Top 10 and provide prioritized remediation guidance without claiming to fix or block requests directly.