OWASP Top 10 Hardening & Anti-IDOR
Enterprise defensive architecture: strict tenant gates, parameterized queries, rate limiting, and signed URLs.
On this page(4)
Role-Based Access Control (RBAC) & Tenant Boundaries
Insecure Direct Object Reference (IDOR) is mitigated through strict server-side identity derivation. Client-supplied tenant or user identifiers in mutation payloads are strictly ignored, and permissions are derived directly from authenticated session tokens.
The matrix below outlines the granular permission boundaries enforced across all workspace roles:
Input Sanitization & Parameterization
No dynamic SQL string concatenation is permitted anywhere in the codebase. All queries run through parameterized Supabase client calls or prepared SQL functions, eliminating SQL Injection.
Short-Lived Signed URLs for Documents
Private employee documents (passports, tax IDs, medical certificates) are stored in private Supabase Storage buckets. Clients access files exclusively through time-limited signed URLs (TTL <= 60 seconds).