ENGINEERING NOTE 11 / 50 · SMS
Prevent cross-account SMS order access
Knowing an order ID must not be enough to read its number or message. Enforce ownership on every order read, cancellation and receipt endpoint.
Published by OPEN RAMBO. The engineering patterns and pseudocode illustrate designs, not a documented product API. Numerical examples are illustrative.
Scope the lookup
Fetch an order with both its identifier and authenticated owner. Checking authentication without checking ownership still allows horizontal access. Apply the same rule to exports and background download URLs, which are often missed during a UI review.
Avoid existence leaks
A public-facing not-found response can cover both missing and inaccessible orders. Internal audit records may distinguish them for security review. Do not return a masked number before authorization; even partial data can reveal another customer’s activity.
Test every action
Create two isolated test users in a test environment and attempt reads and cancellations across the boundary. A successful authorized read does not prove the unauthorized path is safe. Repeat checks after introducing a new provider adapter or export format.
Illustrative implementation
order = find_one({"id": requested_id, "owner_id": session.user_id})
if order is None: return not_found()
return safe_order_view(order)Acceptance check
Assert no number, code or cancellation result is returned for another owner, including through export and retry endpoints.