API security: check access to every object
Being authenticated does not grant access to every resource; understand a common authorization flaw.
The identifier trap
Imagine an endpoint returning an invoice by ID. It requires a valid session but never checks whether the invoice belongs to the current account. A signed-in user can try another ID and retrieve somebody else's data. OWASP lists broken object-level authorization among major API risks.
A complete check
Access depends on identity, any role, the target resource and the requested action. Enforce the policy on the server for every read, update and deletion. In a multi-tenant application, queries must also respect the tenant boundary; hiding a button in the interface offers no protection.
Test with two separate accounts: one creates a resource, and the other tries to read and change it. Both operations should fail unless sharing is intended. Also check that regular users cannot call administrative functions.
It is easier to design access policies early than to bolt them on during a final audit.
Further reading: OWASP API Security Top 10.