Valid JWT Proves Identity, Not Access Rights — Here Is Why That Matters

A security review of the Salus project highlighted a common API vulnerability known as Broken Object Level Authorization (BOLA), where a valid JWT token confirms a user's identity but does not automatically restrict access to resources owned by other users. In the reviewed scenario, an authenticated User B could retrieve patient records created by User A simply because the API queried records by patient ID alone, without verifying ownership. The fix involved scoping database lookups to both the resource ID and the requesting user's ID, ensuring cross-user access is blocked. To avoid leaking resource existence, the API was updated to return a 404 Not Found response instead of a 403 Forbidden when unauthorized access is attempted. The correction was validated through TDD-based security regression tests, which now protect the ownership boundary as the codebase continues to evolve.