title: Web Service Design: Guarding against an unauthorized record id attack
body: <p>I am designing a web application (JavaScript + web service API) for use by multiple users, each with a user role, where the data is held in a shared database and shared tables.  It is vital that a user is never allowed to access data for which he has not been authorized (based on his assigned role).</p>
  
  <p>I am worried about the security threat caused by the following scenario:</p>
  
  <ol>
  <li><p>User X is an admin user for Organisation A and wants to add a user
  to Organisation A's reporting contact group.</p></li>
  <li><p>Using the UI, User X first queries the web service API for a list of available users.</p></li>
  <li><p>The API authenticates and authorizes User X and returns the list of
  user records which User X's role profile gives him access to.</p></li>
  <li><p>However, before hitting the save button, User X injects a User ID which is not in the authorized list into the API call used for updating the contact group.</p></li>
  </ol>
  
  <p>How can I effectively and efficiently secure my web service API against this kind of attack?</p>
  
  <ul>
  <li>Do I provide and expect database primary key Id values in my API calls and apply authorization logic for every Id involved in a specific API call?</li>
  </ul>
  
  <p>or</p>
  
  <ul>
  <li>Do I instead generate a substitute key when I provide the list of authorized records and somehow map it back to the actual primary key when the save/update method is called?</li>
  </ul>