Broken Access Control : Vulnerable and Fixed Code Examples

// BAD: Anyone can access any user profile by changing the userId in the request
@WebServlet("/userProfile")
public class UserProfileServlet extends HttpServlet {
    protected void doGet(HttpServletRequest request, HttpServletResponse response)
            throws IOException {
        String userId = request.getParameter("userId");

        // No authentication or authorization check
        User user = UserDAO.getUserById(userId);

        response.getWriter().println("User Profile: " + user.getName());
    }
}

// GOOD: Enforces authorization before accessing any resource
@WebServlet("/userProfile")
public class UserProfileServlet extends HttpServlet {
    protected void doGet(HttpServletRequest request, HttpServletResponse response)
            throws IOException {
        HttpSession session = request.getSession(false);
        if (session == null || session.getAttribute("userId") == null) {
            response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Login required");
            return;
        }

        String requestedUserId = request.getParameter("userId");
        String loggedInUserId = (String) session.getAttribute("userId");

        // Enforce access control
        if (!loggedInUserId.equals(requestedUserId)) {
            response.sendError(HttpServletResponse.SC_FORBIDDEN, "Access denied");
            return;
        }

        User user = UserDAO.getUserById(requestedUserId);
        response.getWriter().println("User Profile: " + user.getName());
    }
}