Code Review: Authorization & Security Bug

mediumCode ReviewJS / TS

Problem Statement

Review the following document sharing API endpoint. Identify the critical security flaw (Insecure Direct Object Reference - IDOR), explain how an attacker could exploit it, and implement proper authorization checks.

Code under review

JAVASCRIPT• handler.js

Pairlet Snippet

// GET /api/documents/:documentId
async function getDocumentHandler(req, res) {
  const currentUser = req.user; // { id: "user_123", role: "member" }
  const documentId = req.params.documentId;

  const document = await db.query('SELECT * FROM documents WHERE id = $1', [documentId]);

  if (!document) {
    return res.status(404).json({ error: "Document not found" });
  }

  return res.json(document);
}

Read only. Write down what you would flag below, then compare with the reference notes.

JavaScript & TypeScript versions included

Run this as a live interview

Practice solo

Write down what you would flag in this code, then compare it with the reference notes.

Write your findings first, then check yourself against the notes.

Code Review: Authorization & Security Bug

Problem Statement

Code under review

Practice solo

Get new interview exercises