What is an ownership check and why is it important?
Model answer
Verifying that the signed-in user owns the record they are reading or changing, for example Job.findOne({ _id: id, user: req.user.id }). Without it, a user can change someone else's data by guessing ids, a flaw known as broken object-level authorisation (IDOR) and one of the most common API vulnerabilities.
Learn this topic
Login with JWT: Sign In, Issue a Token and Avoid Timing Leaks in the course MERN Stack Full Course: MongoDB, Express, React and Node.js.
Sign in to add your own answer.