Break it, fix it, prove it

Someone else's map

You are signed in as Acme Logistics (customer 1).

The story

Atlas customers fetch their maps with GET /v1/maps/:id. You are a customer, and your maps have ids 1 to 3. Other companies, including competitors, use the same API.

Your goal

Read a map that is not yours.

1. 1Break it
2. 2Fix it
3. 3Prove it

1router.get("/v1/maps/:id", requireApiKey, async (req, res) => {
2  const map = await db.maps.findById(req.params.id);
3  if (!map) return res.sendStatus(404);
4  res.json(map);
5});

Attack

Nothing leaves your computer. No real server is involved.

try these

Hint: Your maps are 1 to 3. Try 4.

Response